Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.
Again, I am not taking the OP seriously, but I do take seriously that people either don't know about fwknopd, or maybe, don't think that is good security (in which case I want to hear from you).
Change protocol from TCP to UPD and port from 22 to 62201.
Remove greeting.
If first message is not the correct password, do not send a reply.
If everyone used this, do you think SSH would become more secure and eliminate password scanners? Personally I think that if ssh took in a fwknopd patch and used that as default, any benefit you see now would disappear. I also suspect that logging every UDP package to 62201 would be a bad idea, probably worse than logging every failed attempt on TCP port 22.
Disclaimer: I'm one of the Fwknop devs. =)
They make the valid criticism of the first case while you argue the second and somehow the arguments miss in the middle.
If I require 5 ports to be hit in sequence, and blacklist IPs that hit unknown ports, it is extremely unlikely you will ever connect. Now if someone on my local network, at my ISP, or at my hosting provider sniffs my traffic to determine a static knocking sequence... good for them. They're the one unauthorized person who can connect to sshd, without a valid ssh key to authenticate with.
It's a reality that most businesses are not going to invest in setting up a network that cannot be accessed from the internet at large. For such setups, a little bit of obscurity via something like port knocking to prevent every single port scanner in existence from discovering your sshd server must be better than nothing at all.
so what happens when someone hits an unknown port on your system from every IP on the internet?
That, and having out-of-band access to the server always helps. ;)
Was looking at ways to decrease logspam from ssh login bots some years ago, port knocking seemed like the most elegant solution. I ended up simply moving ssh away from port 22, the logspam disappeared.
I've used fail2ban in other setups, it also has the advantage of being easy to integrate with other systems such as wordpress, sftp/ftps, nginx, apache.
I have been in this business for a long time and I still look very fondly at port-knocking as a thing that genuinely makes things better.
Almost zero complexity added, super stable knockd daemon, and does a single, simple thing very, very well.
I love port knocking, I love using it, I love the idea of it, and I wouldn't build a server without hiding sshd (and others) behind a knock.
All criticism of port knocking (weirdly) assumes that you also disable all other forms of security and that you rely solely on port knocking, which of course is false.
It is true that port knocking adds just a marginal additional amount of security, but it's still additive and it's still a high return on the (very low) complexity and maintenance.