Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Not Use Port Knocking? (2012)

bsdly.blogspot.in

Post reply on HN
Print view View original

31–40 of 57 posts

Re: Why Not Use Port Knocking? (2012)

#31

Post by sitkack »

teddyh wrote: post #8
marcosdumay wrote: post #6

Earlier quoted context omitted.

The sequence of ports becomes a key. I don't think the principle is violated. What I think is that you should disable password authentication anyway, and adding port knocking to a ssh server that doesn't accept passwords is equivalent to adding a thin wood plank to a 20" steel door with an state of the art lock.

> The sequence of ports becomes a key. Yes, I agree completely. Which is why it buys you nothing compared to simply increasing your password/key lengths with the equivalent number of bits. On the contrary, it introduces confusing complexity for oneself and one’s fellows. Maybe this is what unconscionable people call “Job security”? > equivalent to adding a thin wood plank It is less like a thin wooden plank and more…

Reason by analogy much? Layered security and out of band. Flaw in ssh? Still have another speed bump in the attack vector.

Re: Why Not Use Port Knocking? (2012)

#32

Post by peterwwillis »

tptacek wrote: post #4

Obligatory: I think port knocking is really silly and you shouldn't waste time with it. Disable root logins and password logins in SSH. If you have lots of hosts running SSH, collapse them down to one exposed SSH bastion host. Then get on with your life.

If you're concerned enough to set up an SSH bastion host, do the right thing and set up a VPN. Not only is it a completely separate application (vs two SSH daemons which might both be exploited by a single 0day), it gives you fine-grained control over what users get access to what parts of the network, it doesn't magically grant a user shell, and ultimately allows for tunneling any network service without fumbling with SSH tunneling.

IMO, If your aim is to provide a clandestine entry point to your network, port knocking is amazingly effective. Your host can be completely silent on the internet and seemly be offline but still provide network services. Keep a honeypot online on the same network and most attackers will be busy for weeks/months.

Re: Why Not Use Port Knocking? (2012)

#33

Post by growupkids »

teddyh wrote: post #25
b6 wrote: post #22

Earlier quoted context omitted.

The issue is, the SSH server is many tens of thousands of lines and extremely complex, while a port-knocking implementation might be a few hundred lines and very easy to audit. It's much easier to be certain that the simple one is bug free. The simple one protects the complex one.

If you have cause to worry about security holes in SSH, you should not rely on port knocking to protect you.

That does not follow. Making a service unavailable to an attacker is an excellent way to prevent it from being attacked. And ssh may have holes in it, it was written by people, people make mistakes and there have been holes in it in the past.

Re: Why Not Use Port Knocking? (2012)

#34

Post by lazyant »

zippergz wrote: post #26

I don't use port knocking, and I'm not convinced anyone should. But something bugs me about this kind of discussion. There are two broad classes of attackers: targeted attackers, who specifically want to get into your system, and script kiddies who are scanning broad swaths of the Internet looking for an easy target. Most of these countermeasures, like port knocking and moving sshd to a different port, do very little…

Completely agree, I have the same experience and reached the same conclusion long ago.

Re: Why Not Use Port Knocking? (2012)

#35

Post by teh_klev »

arethuza wrote: post #12

Completely off topic - I find the term "Port Knocking" somewhat amusing as my home village is Portknockie http://www.portknockiewebsite.co.uk/ [NB I say home as my family has been there pretty much forever, I live in Edinburgh]

Heh...unusual to bump into another HN'er from the North East. My folks used to do the family "Sunday Drive" through Portnockie then onwards to Cullen for a fish supper or picnic on Cullen beach. I'm in Dunning now.

Re: Why Not Use Port Knocking? (2012)

#36

Post by clarry »

teddyh wrote: post #2

> Title: Why Not Use Port Knocking? For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, increase your password lengths . If you want to keep log sizes manageable, adjust your logging levels . 1) https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Unfortunately OpenSSH doesn't give you that much control over logging. In my setup I'd like to log successful logins as well as failed login attempts for users that exist, excluding root because logins for root are disabled. This would keep all the scripted (and wholly inneffectual) break-in attempts from flooding the logs while allowing the sysadmin to keep an eye on the more interesting events.

I don't use port knocking, nor do I run sshd on a nonstandard port, but I perfectly understand the people who do that just to keep the log spam down.

Re: Why Not Use Port Knocking? (2012)

#37

Post by ds9 »

tptacek wrote: post #4

Obligatory: I think port knocking is really silly and you shouldn't waste time with it. Disable root logins and password logins in SSH. If you have lots of hosts running SSH, collapse them down to one exposed SSH bastion host. Then get on with your life.

In case anyone ever wonders why "disable password logins" is commonly used as a synonym for "use keys", it's because of the config file and the way SSH for Linux works. If you enable both passwords and keys, then either will succeed instead of both being required! This unintuitive result is a rather dire "gotcha" for anyone new to the task.

Personally I would like to have both, in succession, but have not found a way to configure it. This would be simpler than the SSH-to-SSH solution.

Re: Why Not Use Port Knocking? (2012)

#39

Post by kaoD »

ds9 wrote: post #37
tptacek wrote: post #4

Obligatory: I think port knocking is really silly and you shouldn't waste time with it. Disable root logins and password logins in SSH. If you have lots of hosts running SSH, collapse them down to one exposed SSH bastion host. Then get on with your life.

In case anyone ever wonders why "disable password logins" is commonly used as a synonym for "use keys", it's because of the config file and the way SSH for Linux works. If you enable both passwords and keys, then either will succeed instead of both being required! This unintuitive result is a rather dire "gotcha" for anyone new to the task. Personally I would like to have both, in succession, but have not found a way…

> Personally I would like to have both, in succession

Key files can be password protected. Do you mean "(key+password) + password" or just not aware of passworded keyfiles?

Re: Why Not Use Port Knocking? (2012)

#40

Post by thomaslangston »

srisa wrote: post #27

Each value is a 16-bit number, with a size of two bytes, or equal to two ASCII characters or one Unicode character. Port knocking examples generally do not run to more than three packets, which means that the minimum amount of information a prospective attacker would need to get right in order to gain access is six bytes, equal to six ASCII characters or three Unicode characters. Is the brute force effort being simpl…

Could you clarify your maximum packets math? You may have left out a word or two.
Post reply on HN