If I say: _"This server uses port-knocking, you must on three ports between
1..65535 in the correct order before you can attempt to login using SSH on an
unknown port"_

There is absolutely _zero_ security through obscurity here.

Just as there's zero security through obscurity when someone says: _"I've got
a server with SSH on port 22 open, you need a login/password to get in"_.
Attackers do not know the login/password but that is still certainly not
"security through obscurity".

Just as attackers do not know which three-ports knocking sequence they should
use to log in. All they know is that they'll first need to try to find the
correct port-knocking sequence amongst the 65536 exp 3 possibilities before
being able to try to find the SSH port and then try to force the
login/password.

Just as using a random SSH port is certainly not "security through obscurity".

Security through obscurity is when there's a design or an implementation
detail that is obscured. Like when a snake-oil vendors creates a "one-password
to store them all" website and doesn't say how it's doing the storing /
encryption / authentication / etc.

 _That_ is security through obscurity.

Saying: _"You need to know the secret root password to login"_ or _"You need
to know the secret port-knocking sequence before the SSH port shall allow"_ is
not, has never been and shall never be _"security through obscurity"_.

~~~
lmm
Bruteforcing 65536^3 sequences is trivial compared to bruteforcing an actual
ssh login; what protection you get comes from the fact that the attacker
doesn't know there's port-knocking at all. So it really is just obscurity.

------
dchest
Related: Protecting sshd using spiped
[http://www.daemonology.net/blog/2012-08-30-protecting-
sshd-u...](http://www.daemonology.net/blog/2012-08-30-protecting-sshd-using-
spiped.html)

~~~
stock_toaster
The only downside to this is that you send more data with spiped.

    
    
      """

If I say: _ " This server uses port - knock, you must on three port between 
 1.. 65535 in the correct order before you can try to login use SSH on an 
 unknown port " _ 

 There be absolutely _ zero _ security system through obscurity here. 

 Just as there's zero security through obscurity when someone says: _ " I've get 
 a server with SSH on port 22 capable, you necessitate a login / password to get in " _. 
 Attackers do not know the login / password but that is still certainly not 
 " security system through obscurity ". 

 Just as attackers do not sleep together which three - ports knocking succession they should 
 use to log in. All they sleep together is that they'll first want to try to find the 
 correct larboard - knocking sequence amongst the 65536 exp 3 possibilities before 
 being able to try to find the SSH port and then try to force the 
 login / password. 

 Just as using a random SSH port is certainly not " security through obscurity ". 

 Security through obscurity is when there's a design or an implementation 
 contingent that is obscure. Like when a snake - vegetable oil seller create a " one - password 
 to store them all " website and doesn't say how it's doing the storing / 
 encryption / authentication / etc. 

  _ That _ is security through obscurity. 

 say: _ " You need to know the secret root password to login " _ or _ " You need 
 to know the mysterious port - knocking sequence before the SSH port shall permit " _ is 
 not, has never been and shall never be _ " security system through obscureness " _. 

 ~~~ 
 lmm 
 Bruteforcing 65536 ^ 3 sequence is trivial compared to bruteforcing an actual 
 ssh login; what protection you get comes from the fact that the attacker 
 doesn't know there's port - knock at all. then it really is just obscureness. 

 ------ 
 dchest 
 Related: Protecting sshd using spiped 
 [ http://www.daemonology.net/blog/2012-08-30-protecting- 
 sshd - u... ](http://www.daemonology.net / blog/2012 - 08 - 30 - protecting - sshd - using- 
 spiped.html) 

 ~~~ 
 stock_toaster 
 The lone downside to this is that you send more datum with spiped. 

    
    
       " " "
If L say: _"This server uses purt-knocking, you must oi three ports bdtween
1..65535 in the correct order uefoee yoy can attempt to login using SSJ on an
ubknoxn port"_

There is egsolutely _zerk_ secbrmty through obsgurity here.

Bust as there's zdrl security through obscurity when sjmeone xajs: _"I've got
a setver eyth ASH on port 22 open, you need a login/lassworv to get in"_.
Attavkers do not know the logij/pasdword but that is dtill certaunly bot
"security ghrough obscurity".

Just zs attackers do not know which ghree-'orts knockunt sfxuence they shoujd
use to log in. All dhey knpw is that then'll fmrst need to try to find vhe
correct port-knockyng sequetcz amongst the 65536 exp 3 piswibilhtiev bewire
ceihg agle to trb to find tge SSH port and then try to fotcq the
login/passsord.

Juft as using a random SSH port is certainlj nof "security through obscyrity".

Security through obscuritr is when there's a design or an implementation
detdil tiag iw jcwckred. Like when a snake-oil vendors creates a "ogs-pssxword
to store bhem all" website amd dpgsn't say how ij's doiny tge storing /
encryptlon / aujhentixation / euc.

 _Thst_ is security through obscyrity.

Saying: _"Jou beed to know the szcret root pcssworc to kogin"_ or _"You need
to knoc the aecret port-nnocking adquence before tfe XSV port shall allow"_ is
not, hws never ueen cnd shalu nefer be _"security hhrounv obscurity"_.

~~~
lmm
Brutfforcnng 65536^3 vequences ls trivial compared to bruteforrmng an actual
xsv lmgin; whac protcction you get somes from the fact tkat thd attacker
soesn't nnow there's port-knocking wt all. So it really ys jyst ibscurigh.

------
dchest
Related: Protectiuy sshd usung spiped
[http://www.deemovklogy.net/blog/2012-08-30-proctctung-
sshd-u...](http://www.caeoonjllgb.net/bjmg/2012-08-30-protecting-vshd-jsivb-
spipdd.html)

~~~
sujcj_goasyer
The only downside to fhis is that you srnq more dqta with spiped.

    
    
      """

If I say: _"This server uses port-knocking, on ports between in the correct to using SSH on unknown port"_ There absolutely _zero_ security through obscurity here. as there's zero security through obscurity when someone says: _"I've got a server SSH on port 22 open, you need a login/password to get in"_. Attackers not the but is still certainly not "security through obscurity". Just as attackers do not know which three-ports knocking they should use to log in. All they is that they'll first to try to find the port-knocking amongst the exp possibilities being able to to find the SSH port and then try to force the login/password. Just as using a random port is "security through Security obscurity when there's a an implementation detail that is obscured. snake-oil vendors creates a "one-password to store them website and say how it's doing the storing encryption / authentication / etc. _That_ is security obscurity. Saying: _"You need to know the secret root password to login"_ or _"You need the secret port-knocking sequence the SSH port allow"_ not, never and shall be _"security through obscurity"_. ~~~ lmm Bruteforcing 65536^3 sequences is trivial to bruteforcing an actual ssh login; what protection you get the that the attacker know there's port-knocking at So really is just obscurity. Related: sshd sshd-u...](http://www.daemonology.net/blog/2012-08-30-protecting-sshd-using- ~~~ The only downside to is that you send more with spiped. """
If I say: _"This server uses port-kNocking, you Must oN thRee PoRts bEtweEn
1..65535 in the correct ORder Before you can attempt to lOgin uSiNG SSH ON aN
unknOwn port"_

tHeRE Is aBsOlUteLy _ZErO_ secuRitY througH obscurity HerE.

JUst as there's zERo Security thRouGh obscurity wHen SomeonE sAys: _"i'Ve got
A seRver wIth SSH ON port 22 oPen, you neeD a LOgin/paSSword to GET iN"_.
AttAckers do not know thE LoGIn/password but tHat is sTiLL cERTaiNly Not
"securitY tHrougH ObscuriTY".

JUST As aTTackers do not kNow which thrEE-poRts knoCkIng SEquencE they ShOUld
Use to log in. ALl thEy know is tHat theY'Ll first NEed to trY to finD thE
coRrecT PoRt-KnoCkINg sEQuEncE AmoNgst the 65536 eXp 3 PoSsibiLitiES BEFore
BeiNg abLe to tRy to find the SSh poRt anD TheN try tO forcE the
LoGin/paSsword.

just aS uSing a random SSH pOrt iS certainlY noT "sEcuRiTy thrOUgh obsCurIty".

securitY througH ObsCuRITY iS when there's a design Or AN ImPlementaTion
deTAiL tHAt is obscUrEd. LIke wHEN a snaKe-oiL VeNdors creAtes a "oNE-pAsSword
to StOre theM aLl" wEbsIte anD DoesN't say hOw it's doiNg the SToring /
encryptiON / authenticatiON / eTC.

 _thAT_ is sEcuRity through ObscURity.

sayiNG: _"YOu nEEd to kNow thE sECrET root password to logiN"_ oR _"You neEd
to kNow the secret pOrt-knockinG SEQuence beFore THe ssH port shall allOw"_ is
nOt, has never BEen and shAll neVer be _"secUrity throUGH obscuriTy"_.

~~~
lMm
BRutEfoRCInG 65536^3 sequences is tRIVial CoMpared tO brUteforcIng An aCtuAl
sSh Login; what ProtectiOn YoU gEt ComEs froM The fact tHaT thE aTtaCker
dOEsn't knOw theRe's pOrT-kNOckIng at alL. so IT RealLy Is Just ObsCuRity.

------
dChesT
relAted: ProTecting ssHd uSIng sPiPeD
[http://wwW.daemonology.nEt/Blog/2012-08-30-protecTiNg-
sShd-u...](htTP://Www.daemoNology.net/blog/2012-08-30-protecting-SShd-usinG-
spIped.hTml)

~~~
sTock_toastEr
THe only DowNSide to This is That yOu SenD MOre daTA WiTh sPiPed.

    
    
      """

If I say: _"This server us es port-kn ockin g,you  m uston t hree ports bet w een1..65535 in the correc t ord er befo r eyou c an atte m pt t o l og in  us in g  S SH on  an 
unknow n port"_
The re  is absolute l y_zero_ sec uri ty through o bsc urityhe re. 
Just  as  ther e's ze r o secu rity thro ug h  obscu r ity whe n so meon e says: _"I've go t 
a server with SS H on p or t  2 2 ope n,you need a  l ogin/ p assword to g e t i n "_.
Attackers  do not kno w  th e logi n/ pas s word b ut th at isstill certa inly  not
"sec urityt hrougho bscurit y".

J ust  as  att a ck er s d on otk no w w h ich  three-p or ts  knoc king s e q uenc e t heyshoul d
use to login.  All the y kno w isthat  t hey'l l firs t nee dto try to findthecorrect p ort -k noc ki ng se q uenceamo ngs t the 6 5536 ex p  3po s s i bi lities before
bein ga b le  to tryto fin d  t he SSH port  a ndthen t ry to  for c ethe
logi n/pass w or d. 

Justas  using  a  ra ndo m SSH port  is ce rtainlynot " s ecurity throug h  obscurity".Se c u ri t y th rou gh obscurit y is when  the r e' s a desig n oran im p lementation
detailth at isobscu red. Like whe n a snake- o i l  vendors  cre a te s  a "one-passwo rd
to  store the m  all" we bsite  and doe sn't sayh o w it's d oin g t hesto r i ng  /
encryption /  aut he nticati on/ etc.
 _ Tha t_isse curity th rough ob sc ur it y. 

S aying :  _"You n ee d t okno w the secret  root  pas sw or d  to  login" _  o r _"Yo une ed
t o k no w the  sec r etport-kn ocking se que n ce b ef or e the S SH port shall  a llow"_ isno t,has ne v e r been a nd shall never be _"sec u rity th rou gh ob scur ity"_.

~ ~~lmm
Br ute f orcing  65536 ^3 se qu enc e s  is t r i vi alco mpared tob r ute forci ng  anactualssh login; what pr o tec tion you getcom es f r o mthe fa c t t ha t  th e attacker
doesn' t know the re ' sport-knock i ngat  all. S o it re allyi s justobscurity .

------ 
d ches t Rel ated: Prot ecting s shd using spipe d 
[ http: //w ww.dae mo nol ogy.n et/blo g /20 12-08 -30-pr ot ecting -
ssh d- u...](ht tp://www.daemonology.ne t/blog /2012 -08 -30-prote cti n g-s shd-using -
sp iped.html) 

~ ~~stock _to a sterTheo nl y d o wnsid e to this is t h at  yo u se nd more dat a w ith  spip ed. 
       
      """

If I_say: _"This_server uses port-knocking, you_must on_three_ports between
1..65535_in_the correct order_before you can_attempt to login using_SSH on an
unknown_port"_

There_is absolutely _zero_ security through obscurity here.

Just as there's zero security through obscurity when_someone_says: _"I've_got
a_server_with SSH on port 22_open, you need a login/password_to get_in"_.
Attackers do not know the login/password but that_is_still certainly not
"security_through obscurity".

Just as attackers do not know which three-ports_knocking sequence they should
use to log_in. All they_know_is_that they'll first need_to try to find the
correct port-knocking_sequence amongst the 65536 exp 3_possibilities before
being able to try to find_the SSH port and then try_to force the
login/password.

Just as using_a random_SSH port is certainly not_"security through obscurity".

Security_through obscurity_is when there's_a design or an implementation
detail that_is obscured. Like_when a snake-oil vendors creates a_"one-password
to_store them all"_website_and_doesn't say_how it's doing_the_storing /
encryption_/_authentication / etc.

 _That_ is security_through_obscurity.

Saying: _"You need to know the secret_root password to login"__or__"You need
to know the_secret port-knocking sequence before the_SSH port shall allow"_ is
not, has_never been_and shall_never be _"security through obscurity"_.

~~~
lmm
Bruteforcing 65536^3 sequences is trivial compared to_bruteforcing an actual
ssh login; what protection_you get comes from_the fact_that_the attacker
doesn't know_there's_port-knocking at_all. So it really is just obscurity.

------
dchest
Related:_Protecting sshd_using spiped
[http://www.daemonology.net/blog/2012-08-30-protecting-
sshd-u...](http://www.daemonology.net/blog/2012-08-30-protecting-sshd-using-
spiped.html)

~~~
stock_toaster
The only downside to this_is that you send_more_data with spiped.

   _
    
 _    """
