Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Port knocking

en.wikipedia.org

Post reply on HN
Print view View original

121–130 of 185 posts

Re: Port knocking

#121

Post by doublesCs »

code_duck wrote: post #40
ChrisSD wrote: post #3

Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.

I can't believe the discussion is this long and someone hasn't said 'security by obscurity' yet. Personally, if I was trying to prevent a break-in to a building, I would think it was a great advantage if the attackers had to work hard to even figure out where the doors and windows were.

I believe the "security by obscurity doesn't work" people fall into two types: - those that are coming from a crypto background, where you frame things as "in principle breakable" vs "not breakable, not even in principle" and there's nothing in between, a framework according to which security by obscurity goes into the "in principle breakable" bucket, - people who just mindlessly parrot people of the first type.

A more nuanced (and more useful) way of viewing this is one of cost vs reward: How much does it cost an attack to break your thing, and what's the maximum cost that an attacker is lilely to be willing to invest before your thing becomes unappealing. According to this view, obscurity can significantly increase the cost of the attack. It's as simple as that.

Re: Port knocking

#122

Post by heftig »

steerablesafe wrote: post #93
rsync wrote: post #5

I've been in this business for a long, long time and have come across all manner of innovations regarding network security. Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) stands out as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation. Pay no attention to the nay-sayer…

I would argue that port knocking doesn't implement cryptography, but it implements steganography. It's purpose is not to cryptographically secure your service but to conceal its existence.

Can't we do both? Like, the content of the UDP packet is the output of `date -uIs | gpg --sign`.

Re: Port knocking

#123

Post by Zenst »

it's a great technique, one I used a lot in the late 90's, had a port sequence would ping and that was S/KEY and could run on an nokia or anything that could run java to get the key from the seed. then dydns and could get ssh open and connect. Probably a bit para, but hey, with security it's only paranoid in hindsight if nothing bad happened. Also added extra layer against any zero day upon ssh.

Had it on a openbsd box, firewall script deamon would monitor the firewall logs, pick up the sequence and open ssh for that ip if matched and as sequence was S/KEY, it was always changing. Still cool effective solution.

https://en.wikipedia.org/wiki/S/KEY

Re: Port knocking

#124

Post by aetherspawn »

aasasd wrote: post #112
dvtrn wrote: post #43

Earlier quoted context omitted.

I port knocked called a friend once while traveling overseas when a second friend decided to act like an idiot and got us both some attention by the local authorities. First friend-a local-is the type who doesn’t answer his phone from numbers he doesn’t know/isn’t saved as a contact-which I knew, so I dialed him, then dialed his wife (who also doesn’t answer unknown numbers), then dialed him again. He picked up the s…

Back in the day of payphones and expensive long-distance calls, hitchhikers had a protocol for calling their parents/friends for free: they ring them up but don't say anything. The callee reads a list of expected answers (like the towns where the caller would stay), and the caller hangs up on the right answer, then dials again. Not sure how payment worked and why you could listen for free—I'm only familiar with the m…

Sounds like 1800 reverse where you could send a short 2-3 second message that’s supposed to be your name.

The other person would get an option to receive a call from for $5, but usually is the name or code of a location to be picked up.

I must have done this 100 times as a kid. Once an angry man clued onto it, switched my line across and told me off. This is back in the days where mobile calls were expensive and very few kids had phones.

Re: Port knocking

#125

Post by sokoloff »

hunter2_ wrote: post #76
leeoniya wrote: post #67

Earlier quoted context omitted.

i mean, you're in the security industry, where targeted attacks are the default assumption. the overwhelming majority of web properties are not valuable enough to get this kind of attention. even if security through obscurity is not real protection from targeted attacks, it is at minimum significant noise reduction, and quite possibly a reasonable barrier against drive-bys which assume default configurations. i'm sur…

The whole "obscurity isn't security" thing is a super interesting topic. Suppose you have a static file on a public web server and you want to control access to the file... confidentiality. Many people would agree that if you come up with a long string, don't disclose it to untrusted parties, and use it as a basic auth password, then you have secured the file to some extent. And many people would claim that if you ta…

Topically relevant (and amusing) username!

http://bash.org/?244321

Re: Port knocking

#126

Post by [deleted] »

emiunet wrote: post #101

We like fwknop a lot for its cryptography implementation which can prevent MITM attacks. However, we don't like it for relatively complex client setup. (For example, there is no official iOS client). So we built our own cheap version of port-knocking and called it "doormand". It's just a HTTP server (behind nginx) listening for a POST request from clients. If the request is valid, a new iptables rule is added for the…

[deleted]

Re: Port knocking

#127

Post by tinus_hn »

praptak wrote: post #102
rsync wrote: post #5

I've been in this business for a long, long time and have come across all manner of innovations regarding network security. Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) stands out as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation. Pay no attention to the nay-sayer…

Expanding on that substantive critique, i.e. complexity. Port knocking strips you of the benefits you get from session protocols like TCP. - Fails when packet loss is high. - Fails when lags make the attempts arrive in changed order - Fails when multiple people try to execute the sequence at the same time (yes, you can track source IPs, but then it doesn't work from behind a NAT) Agreed, none of this is a problem on…

You could of course just try again if it fails due to these excessively rare cases.

There are a lot of things that fail if packets arrive out of order and with random packet loss your experience is going to be awful, so both of these are rare.

Re: Port knocking

#128

Post by tinus_hn »

encom wrote: post #103
bcrack wrote: post #94

Earlier quoted context omitted.

Fail2ban [0] bans ip addresses based on failed login attempts (works for more than ssh), minus the isolation layer. [0]: https://www.fail2ban.org/wiki/index.php/Main_Page

fail2ban should be avoided. It does not support IPv6, so should be considered legacy software. EDIT: Source: https://github.com/fail2ban/fail2ban/issues/1123 It appears they have moved forward a little in supporting IPv6, but it's still incomplete. It's unacceptable to not support it fully in 2020.

With IPv6 every user gets an IPv4 internet worth of addresses for himself which makes fail2ban useless.

Re: Port knocking

#129

Post by MaxBarraclough »

leeoniya wrote: post #42
cortesoft wrote: post #37

Earlier quoted context omitted.

What is your conclusion that port knocking has made your network substantially safer based on? Just curious how you measure the effectiveness of something like this.

from personal experience, simply moving ssh off of port 22 cuts your drive-by log noise by 99.9%, which makes auditing clean logs much much easier. failed login attempts with ssh on 22: hundreds per week, after: 0. i imagine with knockd it would go negative.

> simply moving ssh off of port 22 cuts your drive-by log noise by 99.9%, which makes auditing clean logs much much easier.

Is there a reason you can't use some form of IP whitelisting?

I'm not a proper sysadmin, but when I play about on EC2 I always configure the security-group to block incoming connections to TCP port 22 except from whitelisted IPs.

The only time I've had to broaden the whitelist beyond just a few static IPs, is with mobile Internet tethering. They seem to frequently change my IP, so I guessed at my provider's IP range and whitelisted it with a pretty broad wildcard mask. Still much better than accepting connections from any old address.

I can see that my rather simple approach might not scale very nicely.

Re: Port knocking

#130

Post by perlgeek »

tptacek wrote: post #44

Port knocking was somewhat silly when it was introduced ~20 years ago --- at most, on a reasonably designed network, it was saving you from your own misconfigurations, but at least in 2005 it was reasonable to imagine a highly diverse network of machines that people logged into using multiple protocols, where those misconfigurations were likely. In 2020, it's gone past "silly" and is now a design smell, in the same w…

> modern networks are built with short-lived certificates issued off 2FA from an IdP

Modern networks are sadly far too rare; 95%+ of the industry is built on legacy networks.

My take on fail2ban and port knocking are:

* they reduce the amounts of logs produced

* they defend against fully automated at-scale scans / password stuffing attacks that a well-maintained application wouldn't need defending against, but we all know that in any sufficiently big organization, not all applications and accounts will be well maintained.

Post reply on HN