This is, I think, the only valid argument against knocking. The standard (and always condescending) responses are that it is either a very small password and/o

This is, I think, the only valid argument against knocking. The standard (and always condescending) responses are that it is either a very small password and/or that an attacker can record and replay the knock from an eavesdropping position. Both of those are true, of course, but they neglect that the knock is always in addition to whatever else you are already doing to protect ssh. So I have always rejected those arguments and continue to evangelize for port knocking. BUT, the added complexity part is a valid point. I try to keep systems as bare and simple as possible and hate to add even a single unnecessary dependency package. I am happy to say that (on FreeBSD, at least) knock[1] is light, simple, and has run for thousands of days on busy production servers as well as my personal servers without even a single incident. [1] /usr/ports/security/knock