Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Ruroco – like port knocking, but better

github.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: Show HN: Ruroco – like port knocking, but better

#61

Post by Tepix »

mschempp wrote: post #43
Tepix wrote: post #7

The security section fails to explain how the service prevents an attacker from intercepting a packet, then sending it again himself with a new sender IP address to whitelist SSH access his IP address. The original (authorized) sender would then think something went wrong (packet loss), send a new packet and be none the wiser.

Hi Tepix. Im the author of the tool. Thanks for the feedback! It doesn't describe how it prevents that attack, because it doesn't prevent this attack :). As someone else wrote, I could put the IP address of the sender into the encrypted data and validate that in the backend and drop the packet + block the IP address. I will add that in the next release!

No that won't work because the sender doesn't know what the src ip of the packet will be by the time it arrives (NAT is everywhere!)

Re: Show HN: Ruroco – like port knocking, but better

#62

Post by throwitaway1123 »

mschempp wrote: post #60
Jnr wrote: post #59

Earlier quoted context omitted.

IMHO Wireguard + SSH is a better (more robust, widely supported and more secure) approach. Maybe the OP simply hasn't yet heard about or used Wireguard.

"Maybe the OP simply hasn't yet heard about or used Wireguard." I have, but I do not want to run a VPN solution on my private sever, for which I barely have any need. Also Wireguard, although VERY secure is still not "simple" software. In addition there are usecases where Wireguard would not help, for example when I want to open up an http service for the current network that Im in.

WireGuard is honestly very easy to set up. All of the commands feel very straightforward: https://www.procustodibus.com/blog/2020/11/wireguard-point-t...

You can definitely run an HTTP server behind WireGuard. WireGuard just adds a network interface that your server can listen on (e.g. your server would listen on a private address like 10.0.0.1).

Re: Show HN: Ruroco – like port knocking, but better

#64

Post by Jnr »

mschempp wrote: post #60
Jnr wrote: post #59

Earlier quoted context omitted.

IMHO Wireguard + SSH is a better (more robust, widely supported and more secure) approach. Maybe the OP simply hasn't yet heard about or used Wireguard.

"Maybe the OP simply hasn't yet heard about or used Wireguard." I have, but I do not want to run a VPN solution on my private sever, for which I barely have any need. Also Wireguard, although VERY secure is still not "simple" software. In addition there are usecases where Wireguard would not help, for example when I want to open up an http service for the current network that Im in.

Wireguard doesn't require much, since it is part of Linux kernel.

But your use-case with http server is a good one. For similar cases I have used custom forward-auth service, but that still requires to have the web server accessible, while your solution hides it completely.

Re: Show HN: Ruroco – like port knocking, but better

#65

Post by saghm »

> The commands are configured on the server side, so the client does not define what is going to be executed, it only picks from existing commands

Super interesting! From looking at the readme, it looks like the configuration isn't specific to ssh either; I assume you could use it for any service that exposes a port.

Re: Show HN: Ruroco – like port knocking, but better

#66

Post by Jnr »

throwitaway1123 wrote: post #62
mschempp wrote: post #60

Earlier quoted context omitted.

"Maybe the OP simply hasn't yet heard about or used Wireguard." I have, but I do not want to run a VPN solution on my private sever, for which I barely have any need. Also Wireguard, although VERY secure is still not "simple" software. In addition there are usecases where Wireguard would not help, for example when I want to open up an http service for the current network that Im in.

WireGuard is honestly very easy to set up. All of the commands feel very straightforward: https://www.procustodibus.com/blog/2020/11/wireguard-point-t... You can definitely run an HTTP server behind WireGuard. WireGuard just adds a network interface that your server can listen on (e.g. your server would listen on a private address like 10.0.0.1).

OP's example was a great one. For example, let's say you visit your friends and you want to watch some content together that is accessible on your server. Using this approach you can open access to that without setting up Wireguard on friend's smart TV.

And Wireguard does use quite a bit of CPU if you are using a lot of network bandwidth. Small servers don't have that much compute power, so utilizing the port knocking somewhat removes that issue.

Re: Show HN: Ruroco – like port knocking, but better

#67

Post by tptacek »

Jnr wrote: post #66
throwitaway1123 wrote: post #62

Earlier quoted context omitted.

WireGuard is honestly very easy to set up. All of the commands feel very straightforward: https://www.procustodibus.com/blog/2020/11/wireguard-point-t... You can definitely run an HTTP server behind WireGuard. WireGuard just adds a network interface that your server can listen on (e.g. your server would listen on a private address like 10.0.0.1).

OP's example was a great one. For example, let's say you visit your friends and you want to watch some content together that is accessible on your server. Using this approach you can open access to that without setting up Wireguard on friend's smart TV. And Wireguard does use quite a bit of CPU if you are using a lot of network bandwidth. Small servers don't have that much compute power, so utilizing the port knockin…

I don't know that you're right about the WireGuard CPU expense thing.

Re: Show HN: Ruroco – like port knocking, but better

#68

Post by mr_mitm »

mschempp wrote: post #53
mr_mitm wrote: post #8

Pretty cool. Have you seen considerations regarding port knocking by Moxie Marlinspike? I think he raises some valid points: https://github.com/moxie0/knockknock Instead of using UDP he reads the firewall log. Also he prevents replay attacks (even though his implementation is apparently not secure in this regard). Unfortunately his code is ancient and in Python 2, so a rust implementation would be awesome.

One of the reason why I wrote ruroco is, that I can run this from probably anywhere in the world, if I put the service on port 53, because thats DNS and that does not get blocked by any wifi whatsoever. I used to use port knocking, but at some point found myself in a hotel where they blocked ALL ports, except TCP 80 and 443 (did not check UDP at the time). My ssh port is on 80, so I can use all of my tools, even if t…

I mean you can still use 53/udp, but the point is he doesn't start a service or sniff the interface with libpcap, because both of these increase the attack surface.

Re: Show HN: Ruroco – like port knocking, but better

#69

Post by bongobingo1 »

thrwaway1985882 wrote: post #45
bongobingo1 wrote: post #40

Earlier quoted context omitted.

I know its very minor, but are there ergonomic improvements possible to this setup besides shell aliases/functions around pairing `wg-up host && ssh host && wg-down host`? I agree that ultimately, with wg in the kernel, this is a much simpler setup.

From the OpenBSD perspective, I just populate /etc/hostname.wg0 on my laptop with my wg configuration ... and I can immediately `ssh router` at home or on the road :-) IOW, why ever down the connection? Why not start your tunnel immediately when the network comes up and leave it running until the network goes down?

I was thinking about doing this to multiple different servers and thought they could all share the same vpn network address for simpler configuration but now that I think about it doing that might run into constant server-key-changed warnings from SSH.

Re: Show HN: Ruroco – like port knocking, but better

#70

Post by throwitaway1123 »

Jnr wrote: post #66
throwitaway1123 wrote: post #62

Earlier quoted context omitted.

WireGuard is honestly very easy to set up. All of the commands feel very straightforward: https://www.procustodibus.com/blog/2020/11/wireguard-point-t... You can definitely run an HTTP server behind WireGuard. WireGuard just adds a network interface that your server can listen on (e.g. your server would listen on a private address like 10.0.0.1).

OP's example was a great one. For example, let's say you visit your friends and you want to watch some content together that is accessible on your server. Using this approach you can open access to that without setting up Wireguard on friend's smart TV. And Wireguard does use quite a bit of CPU if you are using a lot of network bandwidth. Small servers don't have that much compute power, so utilizing the port knockin…

WireGuard has apps for most devices (macOS, iOS, Android, Windows). For smart TVs it's a bit of a mixed bag. Some of them do support VPN clients, and I know Tailscale works on the Apple TV now (Tailscale uses WireGuard under the hood).

If you're using the Ruroco client to proxy requests to the server, then you could do the same with WireGuard. You could have HAProxy (or something similar) proxy requests from your local network to the WireGuard interface.

Post reply on HN