What type of encryption is used?
Show HN: Ruroco – like port knocking, but better
21–30 of 108 posts
Re: Show HN: Ruroco – like port knocking, but better
#22The example shows you opening port 80 (HTTP standard port), the comment next to it mentions SSH (default port 22). That's confusing. Also your headline claims that your system is "better", but it fails to explain why. Modern port knocking also incorporates secure cryptographic hashes.
I believe the author is comparing their method against just the naive port knocking approach
Re: Show HN: Ruroco – like port knocking, but better
#23Seems really cool! It seems pertinent to remember however that it isn't security as much it is obfuscation.
Re: Show HN: Ruroco – like port knocking, but better
#24[dead]
Re: Show HN: Ruroco – like port knocking, but better
#25I know a guy who works as an IT consultant for a local telecom company. This is what he does: He calls up the data center and says he needs to connect to a server. The support staff there physically walks into the server room grabs an UTP cable and connects a router directly to the blade server. The router then assigns an IP with all ports wide open—no firewall, no nothing. An hour or so later, the support guy calls back to see if the work is done and then unplugs the cable. And that's their whole security protocol
Re: Show HN: Ruroco – like port knocking, but better
#26The security section fails to explain how the service prevents an attacker from intercepting a packet, then sending it again himself with a new sender IP address to whitelist SSH access his IP address. The original (authorized) sender would then think something went wrong (packet loss), send a new packet and be none the wiser.
Even if that was protected against (by putting the source IP inside the payload), I'm not sure it's really much more secure. An attacker who can intercept the packet can likely also spoof the source IP, so the attacker could wait for you to open it with your IP, and then use your IP using spoofing.
Spoofing UDP is easy.
Spoofing TCP is useless - you actually need to receive all the packets sent to the original TCP, which means either you are already on the receiving path, or managed to put yourself on it e.g. through a BGP route advertisement - either way, it leaves some trail and much harder to carry out.
(And even so, the attacker still has to go through SSH authentication or an SSH vulnerability)
Re: Show HN: Ruroco – like port knocking, but better
#27Earlier quoted context omitted.
Encrypting with the private key has the name “signing” because it’s convenient. Both are technically correct.
It sounds like my misunderstanding. So is this just a nomenclature mix up? I'll have to do more research, because I am under the impression there is something special about the private key other than the fact it was designated as such at generation time. I have many holes to fill in my knowledge around this.
Perhaps this helps: While fundamentally, in theory, they (keys and operations) are symmetric, many higher-level cryptographic protocols and their implementation do have differences (such as the private key also embedding the public key, or encryption being hybrid-symmetric). If the abstraction level is not obvious from context and you are still learning, this can be confusing.
Re: Show HN: Ruroco – like port knocking, but better
#28How does this distinguish itself from fwknop?
https://github.com/mrash/fwknop
And what have you got to protest against DoS attacks on your packet inspection mechanism?
Re: Show HN: Ruroco – like port knocking, but better
#29Earlier quoted context omitted.
It sounds like my misunderstanding. So is this just a nomenclature mix up? I'll have to do more research, because I am under the impression there is something special about the private key other than the fact it was designated as such at generation time. I have many holes to fill in my knowledge around this.
Perhaps this helps: While fundamentally, in theory, they (keys and operations) are symmetric, many higher-level cryptographic protocols and their implementation do have differences (such as the private key also embedding the public key, or encryption being hybrid-symmetric). If the abstraction level is not obvious from context and you are still learning, this can be confusing.
Thank you, I think this helped me understand a bit more how higher level protocols impose further restrictions on use: https://crypto.stackexchange.com/a/71362
Re: Show HN: Ruroco – like port knocking, but better
#30Nice. The deadline argument concept is smart and not in many other implementations.
It seems there are two sides of the spectrum for secure SSH access:
+ Relatively infrequent access by limited # of people to servers which are not top targets for attacks. Solutions like the one above are great for this.
+ More frequent, more users, more sensitive servers. Close all the inbound ports, permanently. Example: https://github.com/openziti-test-kitchen/zssh (or with an integrated OIDC like KeyCloak - https://youtu.be/NZJtzSoS_g0?si=Qg6p6Hdkaq1ahefg)