Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Port knocking

en.wikipedia.org

Post reply on HN
Print view View original

31–40 of 185 posts

Re: Port knocking

#31

Post by polishdude20 »

rsync wrote: post #24
acl777 wrote: post #7

Earlier quoted context omitted.

any tips or where one would get best practice for configuring/setting up/using knockd? I wrote up how having a server on the internet is scary now ( http://redgreenrepeat.com/2020/03/20/why-you-should-secure-y... ) and how to protect it ( http://redgreenrepeat.com/2020/04/10/how-to-secure-your-serv... ) One thing I didn't get into more was port knocking/knockd as there were not many resources for it. I'd love to lear…

My default ipfw ruleset is very restrictive - no ports open. The command that gets run when the (correct) knock comes in is an ipfw command: /sbin/ipfw add 01021 allow tcp from %IP% to 10.0.0.10 22,443 setup ... so now the knocking IP can see TCP 22 and 443 (and nothing else). I then have a cron job that runs every night at midnight that deletes those rules: 0 0 * * * /sbin/ipfw delete 01021 ... so I am required to k…

So with poet knocking, if I only have an ssh port open and a couple of ports my servers server content on like an http and https server, I'm assuming id use port knocking to get inside my ssh port right? I don't need to do port knocking for my http and https ports because they're open but not as an ssh service?

Re: Port knocking

#33

Post by bkanber »

What does port knocking look like on the client side? Does ssh have some option that makes it easy? Does everyone just write a custom bash script that wraps ssh client?

Re: Port knocking

#34

Post by mike_d »

jmchuster wrote: post #19
LordOfWolves wrote: post #16

Earlier quoted context omitted.

I enjoyed your story, but can you please elaborate on what your intercom is / was for? I understand the key fob/card concept for access purposes, but have never heard of an “intercom” in the context of home/apartment/etc security.

An intercom that lets someone at the gate talk to the apartment in question to try to convince them to buzz them in?

Yes. They press an apartment number which dials your phone. "Hey your pizza is here", then you press a button on your phone which opens the outer gate or the front door to the building. You then meet them at your front door.

Re: Port knocking

#36

Post by cortesoft »

geoffeg wrote: post #9
rubyn00bie wrote: post #2

And to save other folks a search, this is pretty awesome: https://linux.die.net/man/1/knockd

If someone intercepts the traffic to my server, they could see the knock sequence and re-use it. Is there any way to get knockd to use a google authenticator-like sequence of port knocks?

You block a MITM attack with public key cryptography. Port knocking is not meant to stop MITM attacks.

Re: Port knocking

#37

Post by cortesoft »

rsync wrote: post #5

I've been in this business for a long, long time and have come across all manner of innovations regarding network security. Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) stands out as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation. Pay no attention to the nay-sayer…

What is your conclusion that port knocking has made your network substantially safer based on? Just curious how you measure the effectiveness of something like this.

Re: Port knocking

#38

Post by TedDoesntTalk »

polishdude20 wrote: post #31
rsync wrote: post #24

Earlier quoted context omitted.

My default ipfw ruleset is very restrictive - no ports open. The command that gets run when the (correct) knock comes in is an ipfw command: /sbin/ipfw add 01021 allow tcp from %IP% to 10.0.0.10 22,443 setup ... so now the knocking IP can see TCP 22 and 443 (and nothing else). I then have a cron job that runs every night at midnight that deletes those rules: 0 0 * * * /sbin/ipfw delete 01021 ... so I am required to k…

So with poet knocking, if I only have an ssh port open and a couple of ports my servers server content on like an http and https server, I'm assuming id use port knocking to get inside my ssh port right? I don't need to do port knocking for my http and https ports because they're open but not as an ssh service?

> So with poet knocking

Knocking a poet is bound to get you into trouble. Poets fight back, and hard. Just don't do it.

Re: Port knocking

#39

Post by usr1106 »

nominated1 wrote: post #30

I too am a fan of port knocking. I don’t use knockd, just iptables. I found the Arch Wiki most helpful. You’ll need to figure out which chain works for your setup but it’s pretty straightforward. https://wiki.archlinux.org/index.php/Port_knocking#Port_knoc... Here’s my example for a VPN running on OpenWrt. If you experience any race conditions with iptables you can pepper each rule with something like “-w 5” This ope…

For nftables it's even in the upstream documentation https://wiki.nftables.org/wiki-nftables/index.php/Port_knock...

Re: Port knocking

#40

Post by code_duck »

ChrisSD wrote: post #3

Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.

I can't believe the discussion is this long and someone hasn't said 'security by obscurity' yet.

Personally, if I was trying to prevent a break-in to a building, I would think it was a great advantage if the attackers had to work hard to even figure out where the doors and windows were.

Post reply on HN