Hacker News Reader

Just a thought: in order to make these servers more undercover, you can bundle in a port-knocking daemon (knockd) and have all ports initially closed. This setting should be easily changeable, but it will also tremendously help impair a third party's possibilities of profiling and figuring out valuable info about the server.

View on HN

I haven't ever done anything with port knocking before, but it's a neat idea that could also be entertaining.

It's worth pointing out that most of the services Streisand sets up have already been configured with countermeasures against passive scans. For example, Shadowsocks doesn't respond with any identifying information at all unless you have the proper symmetric key, and OpenVPN will drop all traffic immediately if the connecting client can't sign its requests properly for the HMAC firewall.

Maybe you should look into the more secure fwknop as an option instead of knockd.

Reply on news.ycombinator.com