Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Knocker, a knock based access control system for your homelab

github.com

Post reply on HN
Print view View original

151–160 of 175 posts

Re: Knocker, a knock based access control system for your homelab

#151

Post by tptacek »

Joel_Mckay wrote: post #150
tptacek wrote: post #147

Earlier quoted context omitted.

I don't know what this even means. Do you understand the vulnerability you cited? Can you explain it here?

The relatively benign legacy kernel level pointer-bug CVE chosen is hardly the worst thing from WireGuard or strongSwan over the years. However, it makes the point a priority reliable network side-channel administrative login is more robust under some use-cases. Adding layers of complexity rarely improves security, and doesn't usually address the underlying issue of accountability. And I often ponder if a bastion hos…

The bug you cited is in Netlink. It's not exposed on the network. What's the "worse" thing you're referring to? I think you just searched "WireGuard CVE" and tried to play it off.

Re: Knocker, a knock based access control system for your homelab

#152

Post by fariszr »

tptacek wrote: post #53

I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.

I use tailscale for this. But I can't have two vps running at the same time on android, nor do I want to install tailscale on every device I own. I created knocker exactly for this reason.

Re: Knocker, a knock based access control system for your homelab

#153

Post by fariszr »

myzek wrote: post #2

I don't want to be a hater, but exposing access to your homelab through a "fully vibe coded" application (it's mentioned at the bottom of the README) is probably not a good idea. The idea itself sounds fun though

I mean it's just using firewalld. You can't inspect the rules. For me it's simple enough that it shouldn't be a big security issue, but I understand and that's why I wrote that in the readme.

Re: Knocker, a knock based access control system for your homelab

#154

Post by fariszr »

V__ wrote: post #44
myzek wrote: post #2

I don't want to be a hater, but exposing access to your homelab through a "fully vibe coded" application (it's mentioned at the bottom of the README) is probably not a good idea. The idea itself sounds fun though

> If you're Anti-AI please don't use this. I'm pro security. The gall to put something out there, pretend it being vibe coded is not a big deal and possibly exposing hundreds of people to security issues. Jesus.

I mean you are free to not use it, it's for personal use. I was annoyed by all the vpn based solutions and built knocker to have something that works without installing it on each and every device.

Re: Knocker, a knock based access control system for your homelab

#155

Post by fariszr »

scottydelta wrote: post #24

When every problem seems like a nail then every solution you come up with is a hammer. This is what it feels like people using AI for everything. AI is not good at telling you best solution but it will tell you that you can build it yourself since that approach is what AI is good at. Using self hosted vpn, cloudflare zero trust or Tailscale is the easiest way to go. I self host extensively and have multiple self host…

Tailscale is not as easy as this. It has to be installed on every device or at the router level.

And it will not work on mobile if you already use another VPN.

Re: Knocker, a knock based access control system for your homelab

#156

Post by fariszr »

mano78 wrote: post #3

I implemented something similar as a caddy module, then I realized that if I was connected to a public wifi network I was actually authorizing the whole bunch of people that were connected to it with me. How do you avoid this, or is it just not important?

It's a compromise.It's not as secure as using a VPN, but it's way more convenient, since only one device has to have a knocker client on it without needing any sort of VPN.

The likelihood of someone is on the same network as you noticing your servic, try to hack it, before the TTL expires again is IMO quite low.

This is without taking into account that the services themselves have their own security and login processes, getting a port open doesn't mean the service is hacked.

Re: Knocker, a knock based access control system for your homelab

#157

Post by fariszr »

parliament32 wrote: post #128

The "port knocking" has surfaced often since the early 2000s, but it continues to be a rather silly exercise in making security-by-obscurity look more complicated while not really helping all that much. Briefly looking at the diagram at the top of the repo, it looks like you "knock" with an API key. Why not just run a reverse proxy in front of (whatever service you're trying to protect) and use the API keys there? To…

> Why not just run a reverse proxy in front of (whatever service you're trying to protect) and use the API keys there?

Because it breaks the clients of most homelab services.

That's what authelia does.

Re: Knocker, a knock based access control system for your homelab

#158

Post by fariszr »

lucideer wrote: post #7

> This is ideal for homelab environments where you want to expose services to the internet without a persistent VPN connection, while minimizing your public-facing attack surface. To an untrained eye, the wording here could be construed to imply that this is more secure than a VPN. Might be worth a reword to clarify why one might prefer it want to over a VPN.

Sorry if i wasn't clear. It isn't more secure, it's just more convenient because it works in every network, without needing to set up a VPN connection on each device.

I created this because I always have a VPN on my devices, and I can't have tailscale running with that, in addition to tailscale killing my battery life on android.

Re: Knocker, a knock based access control system for your homelab

#159

Post by fariszr »

yaris wrote: post #11

The authentication part does not look much different from password authentication (key ≈ password), and the "Configurable TTL" bit is somewhat confusing, the first part of the sentence assigns the TTL to API keys but the second part says it applies to IPs being whitelisted. I would expect that TTL for a key means that after the TTL expires the key itself becomes unusable.

The TTL is for the whitelist. The whitelist rules aren't permanent.

Re: Knocker, a knock based access control system for your homelab

#160

Post by fariszr »

Hey I'm the creator of knocker! I actually wanted to write a blog post about it before posting, but OP already did that. If you have any questions just let me know!

Will go into more details why I created in the blog post coming very soon! Just doing the final touches right now.

Post reply on HN