Show HN: Ruroco – like port knocking, but better • Hacker News Board

Re: Show HN: Ruroco – like port knocking, but better

#71

Post by thrwaway1985882 » Fri, Aug 23, 2024, 5:28 PM UTC

bongobingo1 wrote: post #69

thrwaway1985882 wrote: post #45

Earlier quoted context omitted.

From the OpenBSD perspective, I just populate /etc/hostname.wg0 on my laptop with my wg configuration ... and I can immediately `ssh router` at home or on the road :-) IOW, why ever down the connection? Why not start your tunnel immediately when the network comes up and leave it running until the network goes down?

I was thinking about doing this to multiple different servers and thought they could all share the same vpn network address for simpler configuration but now that I think about it doing that might run into constant server-key-changed warnings from SSH.

If you need a management vlan, make one.

Wireguard interfaces are _cheap and easy_ - there's no reason not to set up an interface for normal client traffic that sshd doesn't listen on, and an interface for just sshd with different ACLs and routing logic if you want.

Re: Show HN: Ruroco – like port knocking, but better

#72

Post by Jnr » Fri, Aug 23, 2024, 5:30 PM UTC

throwitaway1123 wrote: post #70

Jnr wrote: post #66

Earlier quoted context omitted.

OP's example was a great one. For example, let's say you visit your friends and you want to watch some content together that is accessible on your server. Using this approach you can open access to that without setting up Wireguard on friend's smart TV. And Wireguard does use quite a bit of CPU if you are using a lot of network bandwidth. Small servers don't have that much compute power, so utilizing the port knockin…

WireGuard has apps for most devices (macOS, iOS, Android, Windows). For smart TVs it's a bit of a mixed bag. Some of them do support VPN clients, and I know Tailscale works on the Apple TV now (Tailscale uses WireGuard under the hood). If you're using the Ruroco client to proxy requests to the server, then you could do the same with WireGuard. You could have HAProxy (or something similar) proxy requests from your loc…

It is much simpler to open access to the same network using port knocking than setting up VPN apps and profiles on TV.

Re: Show HN: Ruroco – like port knocking, but better

#73

Post by Jnr » Fri, Aug 23, 2024, 5:34 PM UTC

tptacek wrote: post #67

Jnr wrote: post #66

Earlier quoted context omitted.

OP's example was a great one. For example, let's say you visit your friends and you want to watch some content together that is accessible on your server. Using this approach you can open access to that without setting up Wireguard on friend's smart TV. And Wireguard does use quite a bit of CPU if you are using a lot of network bandwidth. Small servers don't have that much compute power, so utilizing the port knockin…

I don't know that you're right about the WireGuard CPU expense thing.

My router (with Wireguard) can't handle more than 45Mbit/s through Wireguard because the CPU starts throttling.

I suspect that RaspberryPi or old Intel NUC also would not be able to handle speeds anywhere near gigabit.

Re: Show HN: Ruroco – like port knocking, but better

#74

Post by mr_mitm » Fri, Aug 23, 2024, 5:35 PM UTC

thrwaway1985882 wrote: post #32

mr_mitm wrote: post #8

Pretty cool. Have you seen considerations regarding port knocking by Moxie Marlinspike? I think he raises some valid points: https://github.com/moxie0/knockknock Instead of using UDP he reads the firewall log. Also he prevents replay attacks (even though his implementation is apparently not secure in this regard). Unfortunately his code is ancient and in Python 2, so a rust implementation would be awesome.

> Instead of using UDP he reads the firewall log. Hah! I'd never seen this before, but in a fit of pique driven by ssh scanning one day I did a similar pattern on my OpenBSD router: I added a block in log to a high port in pf.conf, wired up a little shell script that did tcpdump on pflog0 and watched for a packet to come in, then added the IP to the allow port 22 table. I knocked on the door three times, two of which…

Well, tcpdump is explicitely not what you want to do in this case as Moxie points out, but other than that i guess, yes, it's similar.

Re: Show HN: Ruroco – like port knocking, but better

#75

Post by throwitaway1123 » Fri, Aug 23, 2024, 5:42 PM UTC

Jnr wrote: post #72

throwitaway1123 wrote: post #70

Earlier quoted context omitted.

WireGuard has apps for most devices (macOS, iOS, Android, Windows). For smart TVs it's a bit of a mixed bag. Some of them do support VPN clients, and I know Tailscale works on the Apple TV now (Tailscale uses WireGuard under the hood). If you're using the Ruroco client to proxy requests to the server, then you could do the same with WireGuard. You could have HAProxy (or something similar) proxy requests from your loc…

It is much simpler to open access to the same network using port knocking than setting up VPN apps and profiles on TV.

Which smart TVs natively support port knocking?

Re: Show HN: Ruroco – like port knocking, but better

#76

Post by thrwaway1985882 » Fri, Aug 23, 2024, 5:48 PM UTC

mr_mitm wrote: post #74

thrwaway1985882 wrote: post #32

Earlier quoted context omitted.

> Instead of using UDP he reads the firewall log. Hah! I'd never seen this before, but in a fit of pique driven by ssh scanning one day I did a similar pattern on my OpenBSD router: I added a block in log to a high port in pf.conf, wired up a little shell script that did tcpdump on pflog0 and watched for a packet to come in, then added the IP to the allow port 22 table. I knocked on the door three times, two of which…

Well, tcpdump is explicitely not what you want to do in this case as Moxie points out, but other than that i guess, yes, it's similar.

> Well, tcpdump is explicitely not what you want to do in this case as Moxie points out

Why's that?

E: oh, if you aren't familiar with OpenBSD I might get the confusion – pflogd/the kernel (not me!) watches the actual network device and dumps to a file. So the actual "knocking" daemon I bodged together is one part running as a privsep user watching a log file and giving IPs to the other part which just adds to the pf table allowing access.

My threat model didn't include people who can fuck with pflog(4) to attack tcpdump(8) - I'm sure they're out there, and if they wanted to be they'd already be in my network (or already are).

Re: Show HN: Ruroco – like port knocking, but better

#77

Post by mr_mitm » Fri, Aug 23, 2024, 6:10 PM UTC

thrwaway1985882 wrote: post #76

mr_mitm wrote: post #74

Earlier quoted context omitted.

Well, tcpdump is explicitely not what you want to do in this case as Moxie points out, but other than that i guess, yes, it's similar.

> Well, tcpdump is explicitely not what you want to do in this case as Moxie points out Why's that? E: oh, if you aren't familiar with OpenBSD I might get the confusion – pflogd/the kernel (not me!) watches the actual network device and dumps to a file. So the actual "knocking" daemon I bodged together is one part running as a privsep user watching a log file and giving IPs to the other part which just adds to the pf…

Ah, that makes sense. I actually didn't know that about openbsd.

Re: Show HN: Ruroco – like port knocking, but better

#78

Post by tptacek » Fri, Aug 23, 2024, 6:11 PM UTC

Jnr wrote: post #73

tptacek wrote: post #67

Earlier quoted context omitted.

I don't know that you're right about the WireGuard CPU expense thing.

My router (with Wireguard) can't handle more than 45Mbit/s through Wireguard because the CPU starts throttling. I suspect that RaspberryPi or old Intel NUC also would not be able to handle speeds anywhere near gigabit.

My NUC easily pegs the network. I'm not sure you're right about this. Either way: you can just use WireGuard as a control channel, the same way this software does.

Re: Show HN: Ruroco – like port knocking, but better

#79

Post by damezumari » Fri, Aug 23, 2024, 6:23 PM UTC

I think this does what ostiary does except worse. It has replay protection. Of course, that project is long abandoned although I use it.

The only difference is, knocking is via tcp as it makes unique challenges instead of this repeatable udp packet.

Re: Show HN: Ruroco – like port knocking, but better

#80

Post by o11c » Fri, Aug 23, 2024, 6:57 PM UTC

beagle3 wrote: post #37

EvanAnderson wrote: post #35

Earlier quoted context omitted.

> Spoofing TCP is useless... See: https://en.wikipedia.org/wiki/TCP_sequence_prediction_attack It's not practical but it is possible. It was more effective in the past when operating systems had more predictable initial sequence numbers. Famously this is how Kevin Mitnick (allegedly?) attacked Tsutomu Shimomura.

It’s been more than 20 years since any mainstream operating system was vulnerable. IIRC even SYN cookies are older than 20 years at this point.

It is absolutely still a vulnerability; there's no way to protect yourself against someone who can read the sequence numbers anywhere in the middle of the network. Crypto can help you detect this but not prevent it.

RST attacks in particular are common enough to make TCP completely unsuitable for reliable long-term connections. And since TCP is also unsuitable for short-term connections, that leaves UDP the only option.