Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Port knocking

en.wikipedia.org

Post reply on HN
Print view View original

81–90 of 185 posts

Re: Port knocking

#81

Post by Evidlo »

leeoniya wrote: post #42
cortesoft wrote: post #37

Earlier quoted context omitted.

What is your conclusion that port knocking has made your network substantially safer based on? Just curious how you measure the effectiveness of something like this.

from personal experience, simply moving ssh off of port 22 cuts your drive-by log noise by 99.9%, which makes auditing clean logs much much easier. failed login attempts with ssh on 22: hundreds per week, after: 0. i imagine with knockd it would go negative.

> i imagine with knockd it would go negative.

So it's the people running knockd that are actually the ones generating all these ssh login attempts...

Re: Port knocking

#83

Post by vijaybritto »

This was one of the coolest tech that I have implemented!! We used it for authenticating public facing services in a voip application. It worked really well! I was a beginner and I barely understood the benefits. It was the tech leads who guided me to the finish. Such a rewarding experience!

Re: Port knocking

#84

Post by maddyboo »

wave100 wrote: post #72
taliesinb wrote: post #12

I implemented a physical port-knocking daemon, once. I lived in a block of flats — you needed an expensive fob to open the outer gate, and it didn’t even work reliably. I lost my fob. So I took my intercom apart and wired a band pass filter circuit between the buzzer input and actuator output. If you pressed my buzzer with the right steady pattern, it would automatically let you in. It worked great and I didn’t buy a…

I'd have gone the overly complicated route - throw a relay in there and tie it to something that detects whether or not your phone is connected to your WiFi network. Automatically disable it when you're already home!

Until you forget your phone at home and proceed to lock yourself out of your apartment with no way to call for help!

Re: Port knocking

#85

Post by aaronky »

I use port knocking as an emergency backup measure on my bastion host (OpenBSD w/pf). The regular sshd runs on a non standard port with key authentication only. The backup sshd needs to be knocked and allows password authentication. I only use it in emergencies when I don't have my key handy.

I have used it in the past and has saved me a few times. This is only on the bastion.

Re: Port knocking

#86

Post by pwdisswordfish2 »

cortesoft wrote: post #37
rsync wrote: post #5

I've been in this business for a long, long time and have come across all manner of innovations regarding network security. Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) stands out as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation. Pay no attention to the nay-sayer…

What is your conclusion that port knocking has made your network substantially safer based on? Just curious how you measure the effectiveness of something like this.

Could someone point to a contest where an attacker has managed to bypass port knocking. Surely someone has tested its effectiveness at creating more work for attackers.

How can anyone measure the effectiveness of the advice given by a security consultant? It saved a client from disasters that did not happen? How can anyone prove that such disasters would have happened? Answer: Proof of concept.

To question the effectiveness of port knocking, one needs some real stories of real disasters where port knocking was being relied on. Proof of concept. Otherwise all the discussion is still just speculation.

Re: Port knocking

#87

Post by chx »

rsync wrote: post #5

I've been in this business for a long, long time and have come across all manner of innovations regarding network security. Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) stands out as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation. Pay no attention to the nay-sayer…

There's a similar , very sneaky tool: sslh. Practically no automated tools will attempt to SSH into the HTTPS port...

Re: Port knocking

#88

Post by pwdisswordfish2 »

tptacek wrote: post #69
thaumaturgy wrote: post #64

Earlier quoted context omitted.

Sure. Direct answer: search logs across all services and nodes on the network for activity from that source or netrange. See if it's targeting particular usernames, especially anything that shouldn't be guessable. Treat it first as a source of information: did I screw something up somewhere? Have we had an incident I don't know about? If it looks like nothingburger, ignore it and get on with the day. Broader answer a…

I guess that's fair. But: if you buy into this idea, there's a much, much better thing to do: look into Canarytokens. Canarytokens, unlike port knocking, are criminally underused. Really, you should do something similar for your off-port SSH service; don't actually _run_ SSH there, just run a stateless unprivileged service that spoofs a bit of SSH protocol and generates loud alerts. The networks I'm describing aren't…

What happens when the attacker modifies /etc/resolv.conf, disables or does not use DNS while on the network.

What if the attacker does not use software that automatically loads images, like the "canary token" tracking pixels?

What is the attacker opens the files offline?

Canary tokens still work? How?

Why would anyone advise using canary token instead of port knocking? Makes no sense. Why not use both?

Re: Port knocking

#89

Post by tptacek »

pwdisswordfish2 wrote: post #88
tptacek wrote: post #69

Earlier quoted context omitted.

I guess that's fair. But: if you buy into this idea, there's a much, much better thing to do: look into Canarytokens. Canarytokens, unlike port knocking, are criminally underused. Really, you should do something similar for your off-port SSH service; don't actually _run_ SSH there, just run a stateless unprivileged service that spoofs a bit of SSH protocol and generates loud alerts. The networks I'm describing aren't…

What happens when the attacker modifies /etc/resolv.conf, disables or does not use DNS while on the network. What if the attacker does not use software that automatically loads images, like the "canary token" tracking pixels? What is the attacker opens the files offline? Canary tokens still work? How? Why would anyone advise using canary token instead of port knocking? Makes no sense. Why not use both?

I don't even understand the question. We were talking about the value of moving SSH to a different port to cut down on logged probes. That at least has the value of giving you a weak signal about IP sources that are somewhat determined to break in. Port knocking doesn't even do that.

Re: Port knocking

#90

Post by pwdisswordfish2 »

tptacek wrote: post #89
pwdisswordfish2 wrote: post #88

Earlier quoted context omitted.

What happens when the attacker modifies /etc/resolv.conf, disables or does not use DNS while on the network. What if the attacker does not use software that automatically loads images, like the "canary token" tracking pixels? What is the attacker opens the files offline? Canary tokens still work? How? Why would anyone advise using canary token instead of port knocking? Makes no sense. Why not use both?

I don't even understand the question. We were talking about the value of moving SSH to a different port to cut down on logged probes. That at least has the value of giving you a weak signal about IP sources that are somewhat determined to break in. Port knocking doesn't even do that.

Maybe it is not supposed to. Port knocking is not a substitute for anything. Yet most criticisms of it, like yours, seem to assume it is going to be used as a replacement for something else.
Post reply on HN