Earlier quoted context omitted.
Well, my system runs nothing but sendmail, lighttpd (with no modules or features) and sshd. That's it. So there's not much to lock down. sshd is hidden behind port knocking, for what that's worth. (No, I do not want to have a religious argument about port knocking this morning) The real key to the simplicity and security of my setup is email over SSH with a console client. Not only does that remove oceans of attack s…
Thank you for introducing me to port knocking (wikipedia link for the unintiated [0]). Not trying to lure into an argument you're trying to avoid but I'm just curious; what is the religious argument about regarding port knocking? I know about both sides to tabs/spaces and vim/emacs but am curious what people have against port knocking. [0] http://en.wikipedia.org/wiki/Port_knocking
In short, port knocking is a very, very short/weak password. And is a very weak authentication measure.
This is absolutely true and nobody could argue that.
So if you only did port knocking, or if you depended on port knocking, you're making a bad decision.
I believe in defense in depth, and therefore I think that port knocking on top of everything else you already do has good value - especially considering how simple and lightweight knockd is and my experience of it running stably for years at a time.