Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Knocker, a knock based access control system for your homelab

github.com

Post reply on HN
Print view View original

111–120 of 175 posts

Re: Knocker, a knock based access control system for your homelab

#111

Post by dugite-code »

sneak wrote: post #104
dugite-code wrote: post #46

I use fwknop in a similar manner, the main advantage it has is it's using an encrypted UDP packet. It's ability to call shell scripts for more advanced uses is its best feature. I have a packet set up for a rolling restart of all my services as well as ssh access

I use this thing called sshd that listens on only a single port and its main advantage is that it uses actual cryptography to authenticate using a client keypair.

Fwknop uses HMAC keys so quite good crypto by itself, but it's for single shot commands. Good for keeping the ssh port locked until you actually need it. I use it on top of SSH key pairs as part of my layered security, Just as any good access control strategy should.

Re: Knocker, a knock based access control system for your homelab

#112

Post by trelane »

tptacek wrote: post #53

I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.

Do you have a guide to using wireguard in this way?

Re: Knocker, a knock based access control system for your homelab

#113

Post by dugite-code »

tptacek wrote: post #71
hatradiowigwam wrote: post #60

Earlier quoted context omitted.

Fail2ban is not in the same realm as port knocking, and to "bin it" would be foolish security posture at best, and negligent at worst.

No, fail2ban is cargo cult security, and if you actually "need" it, you've misconfigured your system. Don't allow password authentication.

IMHO Fial2ban, just like port knocking, isn't cargo cult security. They are a single tool that can be included in a general system security arsenal, not the only tool you should use but one of a suite of tools that can be used depending on what you want to achieve.

Personally I use fwknop for port knocking as it doesn't suffer from replay attacks as it's an encrypted packet. But still serves the same niche

Re: Knocker, a knock based access control system for your homelab

#114

Post by tptacek »

trelane wrote: post #112
tptacek wrote: post #53

I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.

Do you have a guide to using wireguard in this way?

Using WireGuard in what way? WireGuard defaults to the security posture SPA/port knocking hopes to asymptotically achieve.

Re: Knocker, a knock based access control system for your homelab

#115

Post by trelane »

tptacek wrote: post #114
trelane wrote: post #112

Earlier quoted context omitted.

Do you have a guide to using wireguard in this way?

Using WireGuard in what way? WireGuard defaults to the security posture SPA/port knocking hopes to asymptotically achieve.

> Using WireGuard in what way?

Using WireGuard to gate access to a server. It looks like it's a VPN, not an access control mechanism. So I am curious how this works.

Re: Knocker, a knock based access control system for your homelab

#116

Post by tptacek »

trelane wrote: post #115
tptacek wrote: post #114

Earlier quoted context omitted.

Using WireGuard in what way? WireGuard defaults to the security posture SPA/port knocking hopes to asymptotically achieve.

> Using WireGuard in what way? Using WireGuard to gate access to a server. It looks like it's a VPN, not an access control mechanism. So I am curious how this works.

Set up WireGuard, filter everything but WireGuard (51820/udp) on en0, and then SSH in over the WireGuard connection.

Re: Knocker, a knock based access control system for your homelab

#117

Post by akerl_ »

trelane wrote: post #115
tptacek wrote: post #114

Earlier quoted context omitted.

Using WireGuard in what way? WireGuard defaults to the security posture SPA/port knocking hopes to asymptotically achieve.

> Using WireGuard in what way? Using WireGuard to gate access to a server. It looks like it's a VPN, not an access control mechanism. So I am curious how this works.

WireGuard is sort of a VPN, but really its core is peer to peer links with simple, footgun-resistant configs.

The most mundane setup is two peers with each other’s public keys that let each peer talk to the other via the WireGuard link.

Re: Knocker, a knock based access control system for your homelab

#118

Post by wolrah »

tptacek wrote: post #71
hatradiowigwam wrote: post #60

Earlier quoted context omitted.

Fail2ban is not in the same realm as port knocking, and to "bin it" would be foolish security posture at best, and negligent at worst.

No, fail2ban is cargo cult security, and if you actually "need" it, you've misconfigured your system. Don't allow password authentication.

They can't get in but they can still fill my logs up, so fail2ban cuts them off after a few failures.

Also by collecting data on the IP addresses that are triggering fail2ban I can identify networks and/or ASes that disproportionally host malicious traffic and block them at a global level.

Re: Knocker, a knock based access control system for your homelab

#119

Post by tptacek »

wolrah wrote: post #118
tptacek wrote: post #71

Earlier quoted context omitted.

No, fail2ban is cargo cult security, and if you actually "need" it, you've misconfigured your system. Don't allow password authentication.

They can't get in but they can still fill my logs up, so fail2ban cuts them off after a few failures. Also by collecting data on the IP addresses that are triggering fail2ban I can identify networks and/or ASes that disproportionally host malicious traffic and block them at a global level.

Why bother logging them at all? What is this doing for you? You can't meaningfully characterize attacker traffic this way. They'll come from any AS they want to.

Re: Knocker, a knock based access control system for your homelab

#120

Post by muppetman »

myzek wrote: post #2

I don't want to be a hater, but exposing access to your homelab through a "fully vibe coded" application (it's mentioned at the bottom of the README) is probably not a good idea. The idea itself sounds fun though

Suggesting people don't shoot themselves with a loaded gun is not being a hater, it's being a good person.
Post reply on HN