I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
Yes, which limits the amount of ports they can search and thus can be used to hide things on less popular ports. It is not going to stop an attacker. Just makes their job a bit harder or less complete.