TIL. Basically you type in a password. But instead of fingers, you use HTTP requests. And instead of a keyboard, you use server ports.
Port knocking
111–120 of 185 posts
Re: Port knocking
#112I implemented a physical port-knocking daemon, once. I lived in a block of flats — you needed an expensive fob to open the outer gate, and it didn’t even work reliably. I lost my fob. So I took my intercom apart and wired a band pass filter circuit between the buzzer input and actuator output. If you pressed my buzzer with the right steady pattern, it would automatically let you in. It worked great and I didn’t buy a…
I port knocked called a friend once while traveling overseas when a second friend decided to act like an idiot and got us both some attention by the local authorities. First friend-a local-is the type who doesn’t answer his phone from numbers he doesn’t know/isn’t saved as a contact-which I knew, so I dialed him, then dialed his wife (who also doesn’t answer unknown numbers), then dialed him again. He picked up the s…
Back in the day of payphones and expensive long-distance calls, hitchhikers had a protocol for calling their parents/friends for free: they ring them up but don't say anything. The callee reads a list of expected answers (like the towns where the caller would stay), and the caller hangs up on the right answer, then dials again.
Not sure how payment worked and why you could listen for free—I'm only familiar with the method from written accounts.
Re: Port knocking
#113I implemented a physical port-knocking daemon, once. I lived in a block of flats — you needed an expensive fob to open the outer gate, and it didn’t even work reliably. I lost my fob. So I took my intercom apart and wired a band pass filter circuit between the buzzer input and actuator output. If you pressed my buzzer with the right steady pattern, it would automatically let you in. It worked great and I didn’t buy a…
I have one of those newer intercoms, where you first select who to call, and then it calls the correct flat. So your system wouldn't work.
But you just gave me an idea for something I'll probably never implement: an audio key. The intercom auto-responds and if the audio matches the key (hello 90s modem sounds), then it lets you in. You could add more automation on top and provide temporary keys for guests, etc. Just play the audio you received on whatsapp, it will open the door. Please someone implement this and get rich doing it so that I can just buy it. It needs to take into account when you're at home and you still want to answer the mailman.
Re: Port knocking
#114Earlier quoted context omitted.
from personal experience, simply moving ssh off of port 22 cuts your drive-by log noise by 99.9%, which makes auditing clean logs much much easier. failed login attempts with ssh on 22: hundreds per week, after: 0. i imagine with knockd it would go negative.
I wonder if it would be interesting to load a ssh honeypot that would feed from the logs so it would add the logins and then just dump the ip + input to a file. Honeypot could basically run in a some sort of isolation layer (like Sandboxie or jails) and then self-destruct after the automated script is gone... and then you slam the door on that user/ip combo for good. I can't help but think this would be interesting..…
> then just dump the ip + input to a file.
There are people who do just that.. and then try connect back to that IP with the same credentials. Easy way to find some shells..
Re: Port knocking
#115[deleted]
Re: Port knocking
#116I implemented a physical port-knocking daemon, once. I lived in a block of flats — you needed an expensive fob to open the outer gate, and it didn’t even work reliably. I lost my fob. So I took my intercom apart and wired a band pass filter circuit between the buzzer input and actuator output. If you pressed my buzzer with the right steady pattern, it would automatically let you in. It worked great and I didn’t buy a…
This reminded me of a project Paweł Zadrożniak made on the same idea.
https://www.youtube.com/watch?v=e9GWteVUYD0
http://silent.org.pl/home/2015/10/04/entry-phone-hack/
Re: Port knocking
#117Port knocking is stupid. The only possible real reason anyone should have for actually using it is if they really don’t want their logs to be flooded with the normal internet attacks. Logs which the SSH daemon really shouldn’t (by default) be creating in the first place, since what’s the use? It’s like having a weather station on your roof which always says “it’s raining”, since you live on the ocean floor . It’s the…
I agree with 1. and 3., but not 2.: It's basically like a password where ports are your alphabet.
Assuming you use most of the 2^16 ports, and a typical text password is based on an alphabet of ~70 characters, each knocking step is roughly equivalent to log_70(2^16) ≃ 2.61 traditional password characters.
For example, 5 steps of knocking already entail (2^16)^5 ≃ 1.2*10^24 steps to check. With 1000 attempts per second, that still means trying > 10^13 years until all combinations have been tried.
Re: Port knocking
#118Port knocking was somewhat silly when it was introduced ~20 years ago --- at most, on a reasonably designed network, it was saving you from your own misconfigurations, but at least in 2005 it was reasonable to imagine a highly diverse network of machines that people logged into using multiple protocols, where those misconfigurations were likely. In 2020, it's gone past "silly" and is now a design smell, in the same w…
I use port knocking and I don’t take it seriously. Anyone using it in a serious setup is batshit. However, for fun home projects where users install that giant php based file sharing program, or that IoT camera, why not? They don’t have automated intrusion prevention, etc. They can’t understand the code to determine it’s quality, etc. When the next 0day hits… will it be enough to protect them, yes. After all, they’re…
I don't understand how knocking in if itself is bad. It's just a technique to add a layer of protection.
In my case, all internal services in a kubernetes cluster have no path that allow it to be accessed from the outside. Occasionally, developers might want to do so, say to access a database or prometheus server.
The way to properly do this, imo, is to use a hardened service that functions as a networking proxy. Use proper encryption keys for access, and it should be quite hard to bust open.
Where does port knocking come in? That service should need to be exposed at all times. So, use port knocking to configure the infrastructure to temporarily allow access from your IP, to that proxy servers IP, on that particular port.
I'm more inclined to not take it serious, if such a simple mechanism isn't in place to protect infrastructure.
Re: Port knocking
#119Earlier quoted context omitted.
I use port knocking and I don’t take it seriously. Anyone using it in a serious setup is batshit. However, for fun home projects where users install that giant php based file sharing program, or that IoT camera, why not? They don’t have automated intrusion prevention, etc. They can’t understand the code to determine it’s quality, etc. When the next 0day hits… will it be enough to protect them, yes. After all, they’re…
I don't understand how knocking in if itself is bad. It's just a technique to add a layer of protection. In my case, all internal services in a kubernetes cluster have no path that allow it to be accessed from the outside. Occasionally, developers might want to do so, say to access a database or prometheus server. The way to properly do this, imo, is to use a hardened service that functions as a networking proxy. Use…
*should not need to
Re: Port knocking
#120Earlier quoted context omitted.
There's a similar , very sneaky tool: sslh. Practically no automated tools will attempt to SSH into the HTTPS port...
I presume this connects SSH clients, and serves a fake web page to browsers? Sounds pretty cool, but do SSH clients (e.g. PuTTY need special support for it)
Nope, no support needed. SSLH will proxy SSL traffic to whatever other SSL service you have running (nginx, openvpn, etc.), and send the SSH traffic to openssh. It look like it even supports recognizing plain HTTP traffic as well and proxying it accordingly.