Hacker News Reader

Port knocking is a ludicrous security measure compared to the combination of: * configuring sshd to only listen over a Wireguard tunnel under your control ( or letting something like Tailscale set up the tunnel for you) * switching to ssh certificate authn instead of passwords or keys

View on HN

Does Wireguard work in such a way that there is no trace of its existence to an unauthorized contacting entity?

I used port knocking for a while many years ago, but it was just too fiddly and flaky. I would run the port knocking program, and see the port not open or close.

If I were to use a similar solution today (for whatever reason), I'd probably go for web knocking.

In my case, I didn't see it as a security measure, but just as a way to cut the crap out of sshd logs. Log monitoring and banning does a reasonable job of reducing the crap.

That's one of the original design requirements for wireguard. Unless a packet is signed with the correct key, it won't respond at all.

Reply on news.ycombinator.com