3 ms·
Even so, it is still a very weak security layer that you are adding on to something that is already very secure. Does that really make it less secure? Now runn
by jvdh 13y ago
Even so, it is still a very weak security layer that you are adding on to something that is already very secure. Does that really make it less secure?
Now running SSH on a different port is an even weaker obscurity layer, but still, it still adds some security.
- teddyh 13y agoI think nobody is denying that it adds security. The question is, does the added security offset the increased complexity and associated difficulties?
- rsync 13y agoThis is, I think, the only valid argument against knocking. The standard (and always condescending) responses are that it is either a very small password and/or that an attacker can record and replay the knock from an eavesdropping position. Both of those are true, of course, but they neglect that the knock is always in addition to whatever else you are already doing to protect ssh. So I have always rejected those arguments and continue to evangelize for port knocking. BUT, the added complexity part is a valid point. I try to keep systems as bare and simple as possible and hate to add even a single unnecessary dependency package. I am happy to say that (on FreeBSD, at least) knock[1] is light, simple, and has run for thousands of days on busy production servers as well as my personal servers without even a single incident. [1] /usr/ports/security/knock
- teddyh 13y agoI used the word “complexity” not in the meaning of “the installed system is more complex for having more software in it”, but in the sense of “I don’t want to feel like I’m entering Diagon Alley just for wanting to use SSH” – i.e. complex to use, not complex to set up. But your interpretation works too – they are both valid arguments, in my opinion.