81–90 of 175 posts
The way I see it, port knocking may not be a valid security measure but it can be a good filter. It will allow you to filter out port scanning and other mass cracking attempts. My opinion is that being able to filter out noise and false positives from authentication logs allows you to improve your actual security measures. An other advantage is that it may hide information about your system making it harder for an at…
Earlier quoted context omitted.
If a slow brute force attack is working on your system, all the port knocking and tripwires and whatever are just gimmicks. Don’t waste resources putting lipstick on the pig.
Stolen password-less key bots are also common these days, and again it is more about reducing log noise. "Don’t waste resources putting lipstick on the pig." I would never kink-shame someone that ignored the recent CVE-2025-48416, that proved exposing unprotected services is naive =3
But I see you’ve backpedaled to this being about log noise, not security.
Earlier quoted context omitted.
I’m not super familiar with the intricacies of fail2ban and don’t currently understand why op made that claim but would very much like to know more because he is talking about a topic he is highly regarded for and I respect that. I just don’t have the context.
Port-knocking mainly mitigates slow distributed-brute-force login attacks, and works best when ports are interleaved with several tripwire black-hole and knock-port-close firewall rules. Use-cases: 1. helps auto-ban hosts doing port-scans or using online vulnerability scanners 2. helps reduce further ingress for a few minutes as the hostile sees the site is "down". Generally, try to waste as much of a problem users t…
Your services should simply be unreachable over anything but wireguard (or another secure VPN option).
Earlier quoted context omitted.
There’s a cost with using Asus firmware instead of using stock OpenWRT, which might even be compatible with your router. Many Asus products are compatible, and may even be running OpenWRT themselves. The upshot is you get a nice GUI and a nice out of the box experience, but you’re also phoning home to Asus in small ways, just like one would be if they ran Tailscale. I would agree that stock WireGuard is going to have…
I'm on Merlin currently but I'm in the process of moving over to OPNSense for this exact reason. However, while you can never really trust anything you run with internet access, I feel there's a fundamental line between an explicitly cloud-dependent service like Tailscale (e.g. a Tailscale control server outage incident would impact your home server access) compared to a fully self-hosted service that may or may not…
This is why I mentioned Headscale in the first place. It’s not for everyone or every use case, but it’s good that it exists, on the whole.
Earlier quoted context omitted.
I’m not super familiar with the intricacies of fail2ban and don’t currently understand why op made that claim but would very much like to know more because he is talking about a topic he is highly regarded for and I respect that. I just don’t have the context.
Port-knocking mainly mitigates slow distributed-brute-force login attacks, and works best when ports are interleaved with several tripwire black-hole and knock-port-close firewall rules. Use-cases: 1. helps auto-ban hosts doing port-scans or using online vulnerability scanners 2. helps reduce further ingress for a few minutes as the hostile sees the site is "down". Generally, try to waste as much of a problem users t…
I had some additional logic that gave me a really easy but unintuitive way to tell with an incredibly high degree of confidence the difference between a bot and a human on keyboard scenario and for what it’s worth I think that is the specific thing that makes it worth the effort.
If I have reasons to suspect it’s a bot I just drop the request and move on with my day. The signal to noise ratio isn’t worth it to me.
Earlier quoted context omitted.
WireGuard is designed to be silent preceding a cryptographically authenticated INIT message. It's a superset of whatever security features you'd get from "knocking".
In fairness, most of the fervor for these kind of knock-based flows predate Wireguard existing. They come from the era where OpenVPN and friends were the common practice in that space, and I would not have considered "add OpenVPN" to be a rational way to improve the security of anything I was doing.
“Port knocking” et al were most definitively not.
Port knocking is a very hacky technique that was used: 1- In the 90s were security was whatever 2- In modern days as a way to keep your logs squeaky clean ( although you get 99% there with custom ports) 3- As a cute warm up exercise that you code yourself with what's available in your system. (iptables? a couple of python scripts communicating with each other?) It's not a security mechanism, and downloading external…
There's nothing "hacky" about port knocking. It was never meant to be a complete security solution—nothing is. But it works very well as an additional layer of security. Sec nerds often scoff at "security through obscurity", but it is a very valid strategy. Running sshd on a random high port is not inherently more secure, but it avoids the vast majority of dumb scanners that spam port 22, which is why all my systems…
Earlier quoted context omitted.
Every door you close, is one less someone can break. Every complex services running, is a door someone can potentially break. Even with the most secure and battle tested service, you never know where someone fucked up and introduced an exploit or backdoor. Happened too often to be not a concern. XZ Utils backdoor for example was just last year. > Your network authentication should not be a fun game or series of Rube…
Just to be super clear.. using this in place of something like WireGuard is absolutely not an improvement. It’s actively worse in the majority of scenarios assuming you can manage to secure your keys.
Earlier quoted context omitted.
In fairness, most of the fervor for these kind of knock-based flows predate Wireguard existing. They come from the era where OpenVPN and friends were the common practice in that space, and I would not have considered "add OpenVPN" to be a rational way to improve the security of anything I was doing.
OpenVPN was a perfectly reasonable answer to this problem for many years. “Port knocking” et al were most definitively not .
OpenVPN is basically 1000 configuration options and magic incantations wearing a trenchcoat, and if you get any of them wrong the whole thing crumbles (or worse, appears to work but is not secure).
Earlier quoted context omitted.
Stolen password-less key bots are also common these days, and again it is more about reducing log noise. "Don’t waste resources putting lipstick on the pig." I would never kink-shame someone that ignored the recent CVE-2025-48416, that proved exposing unprotected services is naive =3
If somebody has a stolen credential, they aren’t going to be brute forcing at all. Likewise that CVE wouldn’t be attacked by a brute force attack. But I see you’ve backpedaled to this being about log noise, not security.
One may believe whatever they like, as both our intentions are clear friend.
Have a wonderful day =3