Port knocking
en.wikipedia.org
Port knocking
1–10 of 185 posts
Re: Port knocking
#2And to save other folks a search, this is pretty awesome:
Re: Port knocking
#3Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.
Re: Port knocking
#4Port knocking is great. Also look into honey ports which would be somewhat opposite where you automatically block/log hosts that touch the wrong ports.
Re: Port knocking
#5I've been in this business for a long, long time and have come across all manner of innovations regarding network security.
Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) stands out as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation.
Pay no attention to the nay-sayers and their comical straw-man argument against deploying port knocking by itself. Of course it's not deployed by itself - it is the last layer of defense-in-depth on top of all the other authentication methods you may be doing.
The substantive critique is that you add some amount of complication to your network and introduce a point of failure with knockd - and that is correct. I am happy to report that 15+ years of knockd in production use, all over the world, has produced exactly zero lock-outs or unintentional self-DoS.
Re: Port knocking
#6Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.
If your ssh sever had a 0day, port knocking would protect you.
Re: Port knocking
#7I've been in this business for a long, long time and have come across all manner of innovations regarding network security. Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) stands out as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation. Pay no attention to the nay-sayer…
any tips or where one would get best practice for configuring/setting up/using knockd?
I wrote up how having a server on the internet is scary now (http://redgreenrepeat.com/2020/03/20/why-you-should-secure-y...) and how to protect it (http://redgreenrepeat.com/2020/04/10/how-to-secure-your-serv...)
One thing I didn't get into more was port knocking/knockd as there were not many resources for it.
I'd love to learn more about how you have used knockd.
Re: Port knocking
#8Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.
I would think that if you are going to disparage it, you would at least give one example of why it's unnecessary.
Re: Port knocking
#9And to save other folks a search, this is pretty awesome: https://linux.die.net/man/1/knockd
If someone intercepts the traffic to my server, they could see the knock sequence and re-use it. Is there any way to get knockd to use a google authenticator-like sequence of port knocks?
Re: Port knocking
#10Port knocking is great. Also look into honey ports which would be somewhat opposite where you automatically block/log hosts that touch the wrong ports.
interesting - would this be an effective way to block portscanners?