Hide SSH behind port knocking

With knockd and nftables

Drop SSH by default and accept it only from addresses in a set with a timeout. knockd adds the knocking address to that set; nftables removes it when the timeout runs out, and the established SSH session keeps working.

table inet filter {
    set knocked4 {
        type ipv4_addr
        flags timeout
    }
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif "lo" accept
        tcp dport 22 ip saddr @knocked4 accept
    }
}

The knockd section that fills the set:

[openSSH]
    sequence      = 7311:tcp,8822:tcp,9133:udp
    seq_timeout   = 10
    tcpflags      = syn
    start_command = /usr/sbin/nft add element inet filter knocked4 { %IP% timeout 30s }

Keep permanent access separate

If you also allow some addresses permanently, keep them in a separate set without a timeout. Adding an address that is already in a timed set does not reset its timeout, so mixing both kinds of entry in one set can lock you out when the timer runs out.

Or use fwknop

fwknop SPA is stronger than a sequence: one encrypted, authenticated packet that cannot be replayed. See the fwknop guide.

From your iPhone to SSH

1. 1Hold the brass knocker. Secret Knock checks that port 22 answers and shows how long it stays open.
2. 2Open SSH opens your SSH app with an ssh:// link for the server.
3. 3Keep open knocks again shortly before the window ends, while the door is on screen.

Questions