Port knocking
I've been in this business for a long, long time and have come across all manner of innovations regarding network security.<p>Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) <i>stands out</i> as one of the very few things that made my network(s) substantially safer at nearly zero cost.  I love, and continue to love, both the idea and the implementation.<p>Pay no attention to the nay-sayers and their comical straw-man argument against deploying port knocking <i>by itself</i>.  Of course it's not deployed by itself - it is the last layer of <i>defense-in-depth</i> on top of all the other authentication methods you may be doing.<p>The <i>substantive critique</i> is that you add some amount of complication to your network and introduce a point of failure with knockd - and that is correct.  I am happy to report that 15+ years of knockd in production use, all over the world, has produced exactly zero lock-outs or unintentional self-DoS.