I prefer single packet auth with pyknock [1]. SSH config from client side looks ...

I prefer single packet auth with pyknock [1]. SSH config from client side looks like this:

  Host vm vm-0 vm-0.com
      User user
      HostName vm-0.com
      ProxyCommand sh -c "pyknock-client -s 0.0.0.0 -S \"\$(myip)\" open %h "$(pass my/pyknock/%h)" && sleep 1 && exec nc -4 %h %p"
      Port 1792

Where `myip` [2] is an small utility which reliably detects my external IP address.

[1] https://github.com/Snawoot/pyknock/

[2] https://github.com/Snawoot/myip