Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Not Use Port Knocking? (2012)

bsdly.blogspot.in

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Why Not Use Port Knocking? (2012)

#51

Post by tptacek »

dkl wrote: post #50
tptacek wrote: post #4

Obligatory: I think port knocking is really silly and you shouldn't waste time with it. Disable root logins and password logins in SSH. If you have lots of hosts running SSH, collapse them down to one exposed SSH bastion host. Then get on with your life.

He's why it's not silly and why disabling password logins and using key-based logins in SSH doesn't increase your security: If you turn off password logins, people will use authorized_keys to in effect get a password-less login. If their public key has a password, this is OK, since they're either using ssh-agent or typing in their password at the time of the login. However, what if their ssh key has no password on it…

I'm failing to see what this has to do with the threat model that port knocking addresses. Suffice it to say that an attacker who has access to your SSH identity file has with virtually total certainty access to your SSH passphrase as well.

Re: Why Not Use Port Knocking? (2012)

#52

Post by tptacek »

ds9 wrote: post #44
kaoD wrote: post #39

Earlier quoted context omitted.

> Personally I would like to have both, in succession Key files can be password protected. Do you mean "(key+password) + password" or just not aware of passworded keyfiles?

Different issue. It is definitely best practice to use a long passphrase to protect every secret key, this is off topic. What I meant was, you connect to the SSH server and authenticate cryptographically (use passphrase locally when prompted) - then you also need a logon + password for the SSH server to complete the authentication. This would reject the internet noise banging on the port, but impose a 2 factor test.

If you want two factors for SSH authentication, you can and should set up a two-factor auth system, like Duo.

Re: Why Not Use Port Knocking? (2012)

#53

Post by thwarted »

kaoD wrote: post #39
ds9 wrote: post #37

Earlier quoted context omitted.

In case anyone ever wonders why "disable password logins" is commonly used as a synonym for "use keys", it's because of the config file and the way SSH for Linux works. If you enable both passwords and keys, then either will succeed instead of both being required! This unintuitive result is a rather dire "gotcha" for anyone new to the task. Personally I would like to have both, in succession, but have not found a way…

> Personally I would like to have both, in succession Key files can be password protected. Do you mean "(key+password) + password" or just not aware of passworded keyfiles?

If you can force authentication via both private key and a password, then you're authenticating via both "something you have" (the key), and "something you know" (the password). Having a passphrase on the key protects access to the key, but it doesn't provide any additional levels of authentication to the (remote) system that is requesting authentication — after all, the user could have removed the passphrase from the key file, there's no way for the remote system to know.

Unfortunately, there doesn't seem to be a way to require both a key and a passphrase to be entered. There may be a way to do it with some (custom?) pam configuration/modules, but as far as I know, nothing in sshd itself.

Re: Why Not Use Port Knocking? (2012)

#54

Post by srisa »

thomaslangston wrote: post #40
srisa wrote: post #27

Each value is a 16-bit number, with a size of two bytes, or equal to two ASCII characters or one Unicode character. Port knocking examples generally do not run to more than three packets, which means that the minimum amount of information a prospective attacker would need to get right in order to gain access is six bytes, equal to six ASCII characters or three Unicode characters. Is the brute force effort being simpl…

Could you clarify your maximum packets math? You may have left out a word or two.

Maximum packet maths came from the wikipedia entry. http://en.wikipedia.org/wiki/Port_knocking . First two paragraphs under the "Benefits" section.

Re: Why Not Use Port Knocking? (2012)

#55

Post by phamilton »

thwarted wrote: post #53
kaoD wrote: post #39

Earlier quoted context omitted.

> Personally I would like to have both, in succession Key files can be password protected. Do you mean "(key+password) + password" or just not aware of passworded keyfiles?

If you can force authentication via both private key and a password, then you're authenticating via both "something you have" (the key), and "something you know" (the password). Having a passphrase on the key protects access to the key, but it doesn't provide any additional levels of authentication to the (remote) system that is requesting authentication — after all, the user could have removed the passphrase from th…

Not sure how robust it would be, but you can set a default shell that would be a simple script requiring log in before launching bash. That would give you both.

Re: Why Not Use Port Knocking? (2012)

#56

Post by dkl »

tptacek wrote: post #51
dkl wrote: post #50

Earlier quoted context omitted.

He's why it's not silly and why disabling password logins and using key-based logins in SSH doesn't increase your security: If you turn off password logins, people will use authorized_keys to in effect get a password-less login. If their public key has a password, this is OK, since they're either using ssh-agent or typing in their password at the time of the login. However, what if their ssh key has no password on it…

I'm failing to see what this has to do with the threat model that port knocking addresses. Suffice it to say that an attacker who has access to your SSH identity file has with virtually total certainty access to your SSH passphrase as well.

I'm failing to see what this has to do with the threat model that port knocking addresses.

You said:

I think port knocking is really silly and you shouldn't waste time with it. Disable root logins and password logins in SSH.

I'm pointing out that will lead to less security, not more, for the stated reason.

Suffice it to say that an attacker who has access to your SSH identity file has with virtually total certainty access to your SSH passphrase as well.

How so? By brute for cracking it?

Re: Why Not Use Port Knocking? (2012)

#57

Post by thomaslangston »

srisa wrote: post #54
thomaslangston wrote: post #40

Earlier quoted context omitted.

Could you clarify your maximum packets math? You may have left out a word or two.

Maximum packet maths came from the wikipedia entry. http://en.wikipedia.org/wiki/Port_knocking . First two paragraphs under the "Benefits" section.

I see.

You wrote:

"That equates to a maximum of 655363 packets in order to obtain and detect a single successful opening."

They wrote:

"That equates to a maximum of 65536 ^ 3 packets in order to obtain and detect a single successful opening."

Post reply on HN