| ▲ | LoganDark 3 hours ago |
| Attack surface almost entirely goes away if you just require a good port knock first! I do that with my protection SSH servers and it works just fine. Also prevents anyone from knowing there even is an SSH server there. Or any server if it doesn't respond to pings either, and only uses reverse tunnels to accept public connections |
|
| ▲ | neilalexander 2 hours ago | parent | next [-] |
| Wireguard doesn’t respond to malformed packets or handshakes from unknown devices by design. |
| |
|
| ▲ | mbreese 3 hours ago | parent | prev | next [-] |
| Is there a way to automate port knocks in your .ssh/config? I think that’s the main reason why I haven’t added it to my home server. |
| |
| ▲ | LoganDark 2 hours ago | parent [-] | | Technically you could use a ProxyCommand that does the knock and then runs nc to your target. |
|
|
| ▲ | lakeviewterrace 3 hours ago | parent | prev [-] |
| Port knocking is idiotic and amounts to Biff Tannen's "only I know how to start this car". |
| |
| ▲ | Gigachad 2 hours ago | parent | next [-] | | Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address. | | |
| ▲ | icedchai 2 hours ago | parent | next [-] | | Just moving SSH off a default port gets you 98% there. | | |
| ▲ | LoganDark 2 hours ago | parent [-] | | An attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own. | | |
| ▲ | icedchai 2 hours ago | parent [-] | | I mostly do it to quiet down the noise from the non-stop bots and scanners. | | |
| ▲ | LoganDark an hour ago | parent [-] | | Being off the IPv4 space completely can be even more effective at that, FWIW, but that can have other issues. Only feasible for some! |
|
|
| |
| ▲ | esseph 2 hours ago | parent | prev | next [-] | | LLMs port knock for redteam scans. Have for a long time. | | |
| ▲ | LoganDark 2 hours ago | parent [-] | | My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG. |
| |
| ▲ | 2 hours ago | parent | prev [-] | | [deleted] |
| |
| ▲ | LoganDark 2 hours ago | parent | prev [-] | | It's more like "only I know how to find this keyhole". You still need the key then, you're just also adding some defense against picking. It would be idiotic to use the knock as the only authentication, which is why I don't. To be quite honest, I just like the aesthetics of it. |
|
