Re: [Savannah-hackers-public] Re: [gnu.org #670138] colonialone.fsf.org Dom0 upgrade

[Jim Meyering]

Bernie Innocenti wrote:
> On Sun, 2011-02-20 at 12:13 +0100, Sylvain Beucler wrote:
>> That would be quite inconvenient.
>
> How about bouncing on fencepost, then?

If you're concerned enough to be restricting access to the ssh port,
routing ssh traffic through fencepost could be seen as counterproductive.
Many people have access to fencepost.

I'd go with fwknop:

    http://www.cipherdyne.org/fwknop/docs/SPA.html

i.e., keep the ssh port closed, and open it momentarily only upon
receipt of a packet whose contents is GPG signed by someone we'd let in.