In order to increase security, for example on ssh remote connections, I:

  1. open a non stardard port.
  2. use mandatory digital certificates for authentication.
  3. allow connection from a ip range only.

But I wonder if this is enough to protect my ssh remote access. I was wondering if there is any script or solution doing this:

  • listen on syslog and filter ssh access intents.

  • if a predefined ports sequence is detected, then open for some minutes your non standard ssh port, then close it again if there is no active session.

So this is a "ports key" implementation. Do you know if a similar solution exists? Do you think such a tool is interesting to increase security levels?

  • 1
    Looks like you are asking for port-knocking. There are many posts about this here. Jun 27, 2017 at 9:48
  • 1
    You will also want to look up "security by obscurity". Yes, it adds some level of security, but only by reducing the threat surface a little.
    – schroeder
    Jun 27, 2017 at 9:55
  • Denyhosts or fail2ban will fulfill your first requirement, and your second just describes basic VPN functionality (make certain network resources available for a limited time after authenticating over an unrelated set of ports).
    – Ivan
    Jun 27, 2017 at 15:00

3 Answers 3


Here is an article about port-knocking: https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu

And as schroeder said above - this is security by obscurity, it does not make your system more secure. If you are looking for securing your box and still need access to it from any IP address, consider using VPN with SSL certificates to authenticate against the system and then connect to your SSH server. Otherwise just allow access to your SSH from a range of trusted IPs.


There is a tool for port knocking, knockd used in conjunction with a good firewall like iptables.

Then use a script using nmap or knock to access the port.


That's called port knocking.

A non standard port and port knoching doesn't make your machine more secure, namely if your password is strong, you don't need to use a non standard port. If your password isn't strong, using a non standard port won't help you. The same goes for a certificate.

  • 2
    I do not agree. By moving or even hiding a common port like ssh, you reduce your threat surface, and prevent 99% of the brute-force attempts you might otherwise experience. It's not an account compromise issue, but a load and logging issue.
    – schroeder
    Jun 27, 2017 at 12:24
  • @schroeder, go brute-force my server: that won't make it less secure.
    – Incerteza
    Jun 27, 2017 at 13:59
  • you avoided my point
    – schroeder
    Jun 27, 2017 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .