I agree port knocking is a direct violation of Kerckhoff's principle. However, t... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

mvkg 17 days ago | parent | context | favorite | on: I close SSH port 22 (and what I use instead)

I agree port knocking is a direct violation of Kerckhoff's principle. However, the proposed solution has non-discoverability from unauthorized sources which isn't necessarily in the threat model of OpenSSH or general cryptography. I do feel like this is potentially a desirable trait. I elaborated a bit more here[0], but I'm curious if you have any grander thoughts on how this could be approached

[0]: https://news.ycombinator.com/item?id=49307986

yjftsjthsd-h 17 days ago | [–]

If you want that, I'd personally suggest wireguard. Bind sshd to the wg interface and it'll be invisible.

teddyh 17 days ago | [–]

Non-discoverability is useless.

If you want remote logins with encryption and don’t trust OpenSSH, just use telnet and restrict its access to only IPsec-encrypted packets.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact