Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Knockles – eBPF Port Knocking Tool

github.com

Post reply on HN
Print view View original

1–10 of 24 posts

Re: Show HN: Knockles – eBPF Port Knocking Tool

#3

Post by staticassertion »

Ha, the red balloon in the commit message gave my brain a quick "wait what's wrong, why does this repo have a bunch of red circles?". Just trained to see that and immediately think "something is broken".

Anyway, interesting approach using a secret like this. Is this approach used elsewhere?

Based on this it looks like the service will change what port it's listening on every N seconds. What happens if a port on the server is already open/ reserved though?

Also, not that it really matters from a security perspective, but md5 seems like a bit of an odd choice. There are faster options available. Might be nice to allow it to be configured.

Cool stuff.

Re: Show HN: Knockles – eBPF Port Knocking Tool

#5

Post by eeriedusk »

staticassertion wrote: post #3

Ha, the red balloon in the commit message gave my brain a quick "wait what's wrong, why does this repo have a bunch of red circles?". Just trained to see that and immediately think "something is broken". Anyway, interesting approach using a secret like this. Is this approach used elsewhere? Based on this it looks like the service will change what port it's listening on every N seconds. What happens if a port on the s…

Thanks!

The only tool I can think of right now is moxie0's tool https://github.com/moxie0/knockknock back in 2011.

About the TCP port, if it's already open, you'll just have to wait for the next HMAC because of the very limited communication.

Finally, the choice of md5 was made because of the 16 Bytes output (knockles uses 10 of them), but don't hesitate to make a pull request!

Re: Show HN: Knockles – eBPF Port Knocking Tool

#6

Post by Simsor »

dijit wrote: post #4

Any reason to do this instead of using iptables (which is what people usually use in the linux space for this for over a decade). Example: https://www.digitalocean.com/community/tutorials/how-to-conf...

Correct me if I'm wrong, but I don't think iptables allows you to authenticate the knocks? Also, anyone listening to your network would be able to replay the sequence and open the port.

This project reminds me a bit of moxie's knockknock[1], where the idea of port knocking is kept intact, but with some added security. Plus, it seems really easy to setup, compared to writing dozens of iptables rules.

[1]: https://github.com/moxie0/knockknock

Re: Show HN: Knockles – eBPF Port Knocking Tool

#7

Post by devnull-- »

Simsor wrote: post #6
dijit wrote: post #4

Any reason to do this instead of using iptables (which is what people usually use in the linux space for this for over a decade). Example: https://www.digitalocean.com/community/tutorials/how-to-conf...

Correct me if I'm wrong, but I don't think iptables allows you to authenticate the knocks? Also, anyone listening to your network would be able to replay the sequence and open the port. This project reminds me a bit of moxie's knockknock[1], where the idea of port knocking is kept intact, but with some added security. Plus, it seems really easy to setup, compared to writing dozens of iptables rules. [1]: https://gith…

I confirm, totally

Re: Show HN: Knockles – eBPF Port Knocking Tool

#8

Post by staticassertion »

eeriedusk wrote: post #5
staticassertion wrote: post #3

Ha, the red balloon in the commit message gave my brain a quick "wait what's wrong, why does this repo have a bunch of red circles?". Just trained to see that and immediately think "something is broken". Anyway, interesting approach using a secret like this. Is this approach used elsewhere? Based on this it looks like the service will change what port it's listening on every N seconds. What happens if a port on the s…

Thanks! The only tool I can think of right now is moxie0's tool https://github.com/moxie0/knockknock back in 2011. About the TCP port, if it's already open, you'll just have to wait for the next HMAC because of the very limited communication. Finally, the choice of md5 was made because of the 16 Bytes output (knockles uses 10 of them), but don't hesitate to make a pull request!

Cool cool, thanks. Yeah so I was thinking that blake3 would be a good fit as it's faster (not that it really matters) and safer (again, not that it matters), and it also supports variable key sizes so it'd be easy enough to drop it in.

Given that there's really no major performance/security benefit it's totally fine to use md5 imo, I shouldn't have even mentioned it in retrospect lol I just see "md5" and immediately my brain is like "hmmm".

Collision chance is still pretty low, my guess is that in practice unless you're doing something automated that performs hundreds of SSH's a day you won't run into it (30 seconds of "collision time" every 2-4 hours, based on my math).

Anyway, yeah, super into this.

Re: Show HN: Knockles – eBPF Port Knocking Tool

#9

Post by cryptonector »

From TFA:

  -    A single SYN request is sent on an opened || closed port  
  -    It carries an OTP for authentication so you can be the only one to open a port 
  -    Once authentified, a random (HMAC based) port is opened for a TCP connection 
  -    Then, the port is closed as soon as a connection has been established
Very clever. The fake SYN carries data, an OTP. Very nice!
Post reply on HN