Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Knocker, a knock based access control system for your homelab

github.com

Post reply on HN
Print view View original

91–100 of 175 posts

Re: Knocker, a knock based access control system for your homelab

#91

Post by akerl_ »

Joel_Mckay wrote: post #90
akerl_ wrote: post #82

Earlier quoted context omitted.

If somebody has a stolen credential, they aren’t going to be brute forcing at all. Likewise that CVE wouldn’t be attacked by a brute force attack. But I see you’ve backpedaled to this being about log noise, not security.

Threat detection is a higher security priority than prevention in my experience. One may believe whatever they like, as both our intentions are clear friend. Have a wonderful day =3

It's weird to assign them comparatively like that but also, what does that have to do with fail2ban?

The roving spam it blocks are not threats, and stolen credentials aren't going to be detected by it.

Re: Knocker, a knock based access control system for your homelab

#92

Post by Joel_Mckay »

frumplestlatz wrote: post #83
Joel_Mckay wrote: post #75

Earlier quoted context omitted.

Port-knocking mainly mitigates slow distributed-brute-force login attacks, and works best when ports are interleaved with several tripwire black-hole and knock-port-close firewall rules. Use-cases: 1. helps auto-ban hosts doing port-scans or using online vulnerability scanners 2. helps reduce further ingress for a few minutes as the hostile sees the site is "down". Generally, try to waste as much of a problem users t…

This is a metric ton of completely pointless theater. Your services should simply be unreachable over anything but wireguard (or another secure VPN option).

Depends on the use-case, IPsec is often not supported by many LANs. Also, network crossing is 1 badly configured client away from full infrastructure worming.

At some point, the idealism of white-listed pears and VPN will fail due to maintenance service costs. Two things may be true at the same time friend. =3

https://www.poetry.com/poem/101535/the-blind-men-and-the-ele...

Re: Knocker, a knock based access control system for your homelab

#93

Post by fencepost »

tptacek wrote: post #53

I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.

Knocking can cut down on grinding. I have in the past created setups where you had to knock prior to establishing a VPN connection, and given the semi-regular problems with VPN implementations I really don't feel bad about that. Fortigate, Sonicwall, Cisco, Ivanti, etc - sure a big part of it is "don't run VPNs based on big legacy codebases" but who's to say there won't be implementation problems found (or introduced given "Jia Tan" style attacks) in Wireguard?

Is knocking incredibly weak security through obscurity? Sure, but part of what it does is cut down on log volume.

Re: Knocker, a knock based access control system for your homelab

#94

Post by Joel_Mckay »

mdhb wrote: post #85
Joel_Mckay wrote: post #75

Earlier quoted context omitted.

Port-knocking mainly mitigates slow distributed-brute-force login attacks, and works best when ports are interleaved with several tripwire black-hole and knock-port-close firewall rules. Use-cases: 1. helps auto-ban hosts doing port-scans or using online vulnerability scanners 2. helps reduce further ingress for a few minutes as the hostile sees the site is "down". Generally, try to waste as much of a problem users t…

I recently wrote a deception / honeypot service that does some similar stuff so that all makes sense to me and I think the general strategy of impose costs on attackers by making them expose more of their infrastructure etc are actually a really good move especially in the context of developing an early warning signal. I had some additional logic that gave me a really easy but unintuitive way to tell with an incredib…

I would simply bounce these users to a video game site, that paid us for referrals.

So we made coffee-money wasting spammers time, and attacks stayed rudimentary. =3

Re: Knocker, a knock based access control system for your homelab

#95

Post by fencepost »

frumplestlatz wrote: post #83
Joel_Mckay wrote: post #75

Earlier quoted context omitted.

Port-knocking mainly mitigates slow distributed-brute-force login attacks, and works best when ports are interleaved with several tripwire black-hole and knock-port-close firewall rules. Use-cases: 1. helps auto-ban hosts doing port-scans or using online vulnerability scanners 2. helps reduce further ingress for a few minutes as the hostile sees the site is "down". Generally, try to waste as much of a problem users t…

This is a metric ton of completely pointless theater. Your services should simply be unreachable over anything but wireguard (or another secure VPN option).

"We had a secure VPN option set up, but then we had to replace our Ivanti VPN solution so we switched to Fortigate. Then there were some concerns so we jumped to Sonicwall. After that debacle we finally got the budget to go with Cisco and I'm sure everything will be fine now!"

Re: Knocker, a knock based access control system for your homelab

#97

Post by frumplestlatz »

fencepost wrote: post #95
frumplestlatz wrote: post #83

Earlier quoted context omitted.

This is a metric ton of completely pointless theater. Your services should simply be unreachable over anything but wireguard (or another secure VPN option).

"We had a secure VPN option set up, but then we had to replace our Ivanti VPN solution so we switched to Fortigate. Then there were some concerns so we jumped to Sonicwall. After that debacle we finally got the budget to go with Cisco and I'm sure everything will be fine now!"

I said a secure VPN option.

However, even with all those choices, “port knocking” still wouldn’t be a solution for anything.

[edit]

Are you just searching for random WireGuard CVEs now?

CVE-2024-26950 was a *local-only* DoS and potential UaF requiring privileged access to wireguard netlink sockets.

Re: Knocker, a knock based access control system for your homelab

#98

Post by frumplestlatz »

Joel_Mckay wrote: post #92
frumplestlatz wrote: post #83

Earlier quoted context omitted.

This is a metric ton of completely pointless theater. Your services should simply be unreachable over anything but wireguard (or another secure VPN option).

Depends on the use-case, IPsec is often not supported by many LANs. Also, network crossing is 1 badly configured client away from full infrastructure worming. At some point, the idealism of white-listed pears and VPN will fail due to maintenance service costs. Two things may be true at the same time friend. =3 https://www.poetry.com/poem/101535/the-blind-men-and-the-ele...

Yes, and those two true things are:

- You should be using WireGuard.

- “Port knocking” is pointless theater.

Re: Knocker, a knock based access control system for your homelab

#99

Post by tptacek »

fencepost wrote: post #93
tptacek wrote: post #53

I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.

Knocking can cut down on grinding. I have in the past created setups where you had to knock prior to establishing a VPN connection, and given the semi-regular problems with VPN implementations I really don't feel bad about that. Fortigate, Sonicwall, Cisco, Ivanti, etc - sure a big part of it is "don't run VPNs based on big legacy codebases" but who's to say there won't be implementation problems found (or introduced…

There is literally no value to cutting down on WireGuard attempts. Like, the exact same set of skbuffs are being created and destroyed in either case.

Re: Knocker, a knock based access control system for your homelab

#100

Post by Joel_Mckay »

akerl_ wrote: post #91
Joel_Mckay wrote: post #90

Earlier quoted context omitted.

Threat detection is a higher security priority than prevention in my experience. One may believe whatever they like, as both our intentions are clear friend. Have a wonderful day =3

It's weird to assign them comparatively like that but also, what does that have to do with fail2ban? The roving spam it blocks are not threats, and stolen credentials aren't going to be detected by it.

In general, bots/worms/clowns will first check if a host/router is already infected or vulnerable to a shim. Thus, tripwires on those checks or URI often auto-ban infected/hostile hosts before a scan fully escalates to a successful payload. Note, people don't want a VM delta-snapshot of their zero-day around for automated analysis.

99.98% of hostile traffic simply reuse already published testing tools, or services like Shodan to target hosts.

One shouldn't waste resources guessing the motives behind problem traffic. =3

Post reply on HN