Most SSH hardening guides stop at key-only auth and fail2ban . That helps, but if your machine has a public IP, port 22 is still open to the internet. Every automated scanner can probe it and get a response: the SSH version string, the banner, proof that something is listening. The log noise alone is annoying: even with key-only auth, failed attempts pile up every day. But the bigger problem is exposure. If a zero-day drops in OpenSSH , every server with port 22 open is a target before you have time to patch. That has happened before. I wanted the SSH daemon itself to be unreachable: no banner, no version string, nothing for nmap to work with. Not just rate-limited or hidden behind a non-standard port, but genuinely not connectable unless you already hold the key. The idea: port knocking, and why it is not enough on its own Link to heading Port knocking is the original approach to this problem. The idea is simple: the server watches for a specific sequence of connection attempts on closed ports.…