[b6]

The issue is, the SSH server is many tens of thousands of lines and extremely complex, while a port-knocking implementation might be a few hundred lines and very easy to audit. It's much easier to be certain that the simple one is bug free. The simple one protects the complex one.

[teddyh]

If you have cause to worry about security holes in SSH, you should not rely on port knocking to protect you.

[growupkids]

That does not follow. Making a service unavailable to an attacker is an excellent way to prevent it from being attacked. And ssh may have holes in it, it was written by people, people make mistakes and there have been holes in it in the past.

[belorn]

Adding a port knocking in front of your ssh server do not make the service unavailable to attackers. At best it deter some attackers, based on the same principal that some store owners puts up a cardboard box painted to look like a video camera. If the added "security" prevents most onlookers and casually would-be-attackers, then the cardboard box is indeed an excellent way to prevent the store from being attacked.

It is still however a cardboard box with paint on it. The effectiveness disappear the second criminals bother to test the illusion. What I then wonder is, did the store owner trust the cardboard box effect to the degree of not installing a proper door, lock and alarm?