I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
Those are not port scans though. A port scan is when someone is systematically checking a large number of ports on a system to find which ones are open and possibly what is running on them. A random connection to a single port is not a port scan and not something pretending that other ports are open will help at all with. And open services are typically announced in some other way and don’t require scanning all ports on the whole internet to find. Though you may get connections from people that get the address wrong, or have an old IP that has been reused or something - those are not scans though.
I never said that. I have mentioned actual use cases for wanted this in other comments in this thread - namely slowing down attackers by making them do more work by not being able to do quick checks for open ports. My responses here though are about the postulation that you could gain extra information with an open port in eBPF vs just a closed one or simply a service running on that port. Thus I do not think that is the reason you would want this. Never said there are no reasons at all that you would want to pretend ports are open.