Live data from Hacker News

Show HN: Knockles – eBPF Port Knocking Tool

github.com

21–24 of 24 posts

Re: Show HN: Knockles – eBPF Port Knocking Tool

#21

What are use cases for something like this?

It's a mechanism to deny attackers access to consuming your stateful resources. Attackers without the secret can't consume any more resources than sending you a packet that you perform a maccheck on.

UDP could be used instead but it's not uncommon for it to get blocked by firewalls. This approach will have its own, but different, issues with firewalls.

This kind of tool is used to do things like allow remote SSH access without getting inadvertently connection and log flooded by overzealous password crackers or exposing the service to enumeration.

It can also be used to protect weaker protocols that don't have adequate security internally (e.g. where you don't trust that they're not exploitable) but that you only need limited access to for emergency purposes.

Re: Show HN: Knockles – eBPF Port Knocking Tool

#23

From TFA: - A single SYN request is sent on an opened || closed port - It carries an OTP for authentication so you can be the only one to open a port - Once authentified, a random (HMAC based) port is opened for a TCP connection - Then, the port is closed as soon as a connection has been established Very clever. The fake SYN carries data, an OTP. Very nice!

Can't all that be done without eBPF in a normal userspace program?

Re: Show HN: Knockles – eBPF Port Knocking Tool

#24

From TFA: - A single SYN request is sent on an opened || closed port - It carries an OTP for authentication so you can be the only one to open a port - Once authentified, a random (HMAC based) port is opened for a TCP connection - Then, the port is closed as soon as a connection has been established Very clever. The fake SYN carries data, an OTP. Very nice!

Can't all that be done without eBPF in a normal userspace program?

Yes, using SOCK_RAW.
Post reply on HN