Just moving SSH off a default port gets you 98% there.
replyAn attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own.
replyI mostly do it to quiet down the noise from the non-stop bots and scanners.
replyBeing off the IPv4 space completely can be even more effective at that, FWIW, but that can have other issues. Only feasible for some!
replyLLMs port knock for redteam scans. Have for a long time.
replyMy knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.
replyThat's not a knock, it's a password :-)
replyI mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...
replyThat’s cute. Have Claude do it. There is already an echo system of TOPT QR to communicate it, so you would just need to convert your six digit code to two or more hits on the 16bit port range.
replyI’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.
deleted
reply