for my internet-facing machines I black-hole everything below 1024 and move SSH to something high but easy enough to remember like 22222
If I was an evil hacker I would look at that port and other variants of 22 like 2200, 2222, etc for people's ssh.
and then all you'd have to do is compromise SSH on my fully patched system
of course the point is not to be able to withstand an attack by a persistent attacker. it prevents my logs from filling up with the constant scans from scripts
Does this have any advantages over using plain wireguard? WG operates purely over UDP and doesn't respond unless you send it packets with an authorized key, so it's essentially the VPN and port knocking all in one.
I guess if you only have the key, you would still need to figure out how to use it
I think "attacker has a private key" is an unreasonable threat model to protect against, not least because the key is so much harder to crack than port knocking. The benefit to port knocking is against information disclosure ("this server is running Apache httpd version x.y and sshd version z"), brute force, noisy logs, and pre-auth vulnerabilities (things like heartbleed and shellshock). While in theory I suppose wireguard could be affected by pre-auth vulnerabilities and maybe a completely blind bruteforce attack, it's a listening UDP port that doesn't respond until it sees valid credentials, so it's completely invisible to an attacker.
That page links to a http insecure download script, weird. (Not https, no signature) This link: wget http://www.thoughtcrime.org/software/knockknock/knockknock-0...
Yeah, the documentation is dated. Not only does it point to an old version, but it would probably be best to get it from the GitHub page he links to. Even then, there are more active forks, so they may be worth checking out to see which would be best to get on board with.
Then ssh would protect you. The two having zero days at the same time is unlikely.
Not necessarily, imagine a port knocking monitor that stores each port attempt it sees in a large buffer. Imagine you make many attempted connections allowing you to overflow the buffer and write arbitrary data onto the heap.
Or the monitor being written in c and analyzing text in the knock messages, e.g. looks and interprets a hash
I'd have gone the overly complicated route - throw a relay in there and tie it to something that detects whether or not your phone is connected to your WiFi network. Automatically disable it when you're already home!
Until you forget your phone at home and proceed to lock yourself out of your apartment with no way to call for help!