3 ms·
Just a thought: in order to make these servers more undercover, you can bundle in a port-knocking daemon (knockd) and have all ports initially closed. This sett
by thegeomaster 12y ago
Just a thought: in order to make these servers more undercover, you can bundle in a port-knocking daemon (knockd) and have all ports initially closed. This setting should be easily changeable, but it will also tremendously help impair a third party's possibilities of profiling and figuring out valuable info about the server.
- jlund 12y agoI haven't ever done anything with port knocking before, but it's a neat idea that could also be entertaining. It's worth pointing out that most of the services Streisand sets up have already been configured with countermeasures against passive scans. For example, Shadowsocks doesn't respond with any identifying information at all unless you have the proper symmetric key, and OpenVPN will drop all traffic immediately if the connecting client can't sign its requests properly for the HMAC firewall.
- kolev 12y agoMaybe you should look into the more secure fwknop as an option instead of knockd.