Knockknock: Simple, secure, and stealthy port knocking implementation (2012)

by Bluestein • 2 years ago

90 82 2 years ago

this is from 2012, must be run as root, uses python 2, and requires "hping3"

gawa• 2 years ago

It also works only with iptables. And because it's from 2012, it's watching the file /var/log/kern.log [0], which was a simple way to monitor for incoming packets in 2012, but will not work anymore with systemd based distributions nowadays, since all logs are binary and thus accessible through an util such as journalctl.

Someone opened a PR to address this [1]. It tries to keep it simple in the spirit of the tool, but it adds another dependency (a systemd python module).

I like it overall. The code is so small and simple, it's easy to adapt and to keep small anyway, whatever distro and firewall one might end up use it with.

[0] https://github.com/moxie0/knockknock/blob/bf14bbffc5f1d2105c... [1] https://github.com/moxie0/knockknock/pull/7

beeman• 2 years ago

A similar tool that's actively developed was posted a few days ago.

https://news.ycombinator.com/item?id=41327735

Show HN: Ruroco – like port knocking, but better

https://github.com/beac0n/ruroco

fooqux2• 2 years ago

I used to use lots of port knocking setups to hide my ssh port. That was, until I discovered Tailscale's SSH setup. Now my SSH is run over wireguard which is very stealthy.

ray_v• 2 years ago

Same. It's amazing not having my server hammered by malicious actors and hardening it by not even offering the ssh service on the primary network interface

Demiurge7• 2 years ago

Why is it so amazing? Sounds more complicated than fail2ban. I've been installing fail2ban for decades on countless servers, using decent passwords, and have never had SSH get brute-forced. It’s anecdotal, but if you’re getting blocked after three wrong attempts, the chances of a successful attack are pretty small. So, why bother with nonstandard ports or even other protocols?

jjeaff2• 2 years ago

I also love tailscale's ssh option. I have been using it for a few months now. But I'm a little bit scared that if the tailscale daemon crashes, I'll lose access to my server.

dvzk2• 2 years ago

You would also be locked out if you ran OpenSSH on Tailscale's autoconfigured WG interface. Setup WireGuard manually, or enable serial console login, or make sure your servers are dispensible. Tailscale (and Nebula) mostly alleviate the last case.

fooqux2• 2 years ago

Same could be said for the sshd service crashing. And yeah, I suppose you could say it's got a longer track record, but I've yet to have tailscale crash on me in a few years.

commercialnix2• 2 years ago

Knockknock was one of my favorite things back in the day. I love Moxie's mindset. Nowadays I put Wireguard in front of everything.

lfmunoz4• 2 years ago

Been wanting to use wireguard but seems like a lot of effort of managing keys and ip addrseses and routing rules etc. Do you have resources that might help me understanding the best setup?

fragmede4• 2 years ago

Tailscale is wireguard underneath and does all that managing for you.

commercialnix2• 2 years ago

When Wireguard first came out I wrote some scripts for myself. Later on I used SaltStack to configure Wireguard for customers with sets of laptops in the dozens or more.

https://Netbird.io is probably something you may be interested in.

dvzk2• 2 years ago

WireGuard is extremely easy to setup. It's difficult to manage if you have hundreds of nodes or dynamic endpoints: that's what Tailscale and Netmaker helps with.

OpenBSD's wg documentation is straightforward. It maps onto wireguard-tools' configuration concepts if you need to use Linux.

1. https://man.openbsd.org/wg.4

2. https://man.openbsd.org/ifconfig.8#WIREGUARD

3. https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8

With OpenBSD you will typically end up with a hostname.wgN config that looks like this:

  inet6 fd00:abcd:efgh:ijkl::1/48
  wgkey <base64-private-key>
  wgport 51820
  wgpeer <base64-peer-pubkey> \
    wgpsk <base64-secret> # optional \
    wgaip fd00:abcd:efgh:mnop::1/64 \
    wgendpoint x.x.y.y 51820
  up

TZubiri2• 2 years ago

Port knocking is supposed to be a last, self made, no dependency, cheap, cute layer of defense.

Installing external dependencies, even from someone trusted like Moxie, is counterproductive. The more system you have the more vulnerabilities, less is more.

I've actually been fired over this, we were building a product, and I implemented port knocking in python. Lead said it was unsecure and wanted to install an encrypted port knocking protocol.

EDIT: Just read the readme, Moxie is saying the same thing verbatim lol, we cool

teruakohatu• 2 years ago

I've actually been fired over this,

Why exactly where you fired? Because you used python?

TZubiri2• 2 years ago

Didn't follow instructions to the T. E.g: install a port knocker vs implementing a port knocker in python

andrewstuart• 2 years ago

Is port knocking really a security thing or is it theater?

orev2• 2 years ago

Security is built in layers. Is it theoretically possible for someone on the network to observe the knock sequence? Yes. Is it likely to happen in any but the most adversarial of conditions? No. And if it’s implemented in a cryptographically secure way, like fwknop, then it’s really very good.

tptacek8• 2 years ago

One of the oldest canards in security: "defense in depth", "security is built in layers", which you can use to justify any performative measure.

tptacek8• 2 years ago

Pure theater.

mscdex• 2 years ago

In my opinion it's primarily for less noisy logs.

Joel_Mckay2• 2 years ago

Prevents some types of distributed slow brute force attack, port scans, and 99.98% of nuisance traffic on the ports. Most effective when interleaved with port-sequence-close and port-trip-wire firewall random-delayed black-hole rules. Note login time window restrictions and fail2ban should also be active.

Obfuscating your ssh traffic over SSL or Iodine tunnel traffic can punch through many sandbox networks that try to jack secure traffic.

People will argue time constrained tap sequences (think Morse code) are also easily logged with a sniffer, but in general fail2ban rules can email you as the ssh noise should be nearly nonexistent.

i.e. One can determine if a route/VPN is attacking secure traffic links, or has uncanny insight into internal security policy.

Some people post bad policies for setting up ssh, email, and web servers...

Setting up knocking should be the first step on a new server image, as many folks lock themselves out the first run (and on some occasions need to re-image the host). =3

fulafel• 2 years ago

As a workaround for vulnerabilities in your ssh implementation ("Why Is This Even Necessary") this seems timely given the recent OpenSSH flaw. I wonder if this still works after 12 years of no commits.

spiped has been another tool sometimes recommended for addressing this and seems more maintained.

exabrial• 2 years ago

I mentioned this awhile back:

Port Knocking, but the port combination is based on TOTP protocol and has a "use once" feature. Basically rotating protocols :D

thomashabets24• 2 years ago

Port knocking is a stupid concept. You're sending a password (or TOTP) in plaintext. Just send an UDP packet with the password in it, and be honest about it.

Just to prove a point, I made two port knockers using just an UDP packet in a few lines of bash. One uses OpenBSD's signify to sign unlock requests, and the other is on the server side just nftables config to check a static UDP packet, not even a binary.

https://github.com/ThomasHabets/udportknock/blob/master/gen-... Modulating TCP SYN packets? Eyeroll.

Joker_vD2• 2 years ago

From what I understand, this project does not send a "password": its impossible to replay the requests.

thomashabets24• 2 years ago

By "this project" you mean OPs link?

Sure, many portknocking projects are non-replayable (including the other script in the one I linked to, using OpenBSD's Signify).

But what I'm saying is that OTP or not, it's sent in plain text. But "port knocking" is usually this silly modulation over SYN packets.

I mean that an OTP sent in plain text is still sent in plain text. Using a series of SYN packets is no more encrypted than just sending it as a UDP packet. SYN modulation is not encryption.

Of course non-replayable is better than replayable. I'm not objecting to that. I'm objecting to modulating over SYN packets.

rsync• 2 years ago

Port knocking is a simple and effective addition to a defense-in-depth strategy.

Whatever layers of defense you already have in front of your ssh server, port knocking makes it (very slightly) safer.

If knock/knockd were fragile or complex then you’d need to carefully weigh that benefit against increased fragility.

But it’s not. You get the benefit at no real cost.

(I speak of the knock binary in FreeBSD ports - I have no experience with this weird python one …)

thomashabets24• 2 years ago

Ok, I should have been more clear.

Modulating SYN packets is stupid.

Port knocking by sending a secret to the server, in a very simple protocol (to the point of being obviously correct), is good. Once it gets too complex, the implementation is more likely to have a bug than OpenSSH.

So just send that secret in a UDP packet. Modulating SYN packets is like sending your password (or other secret) in morse code rather than ASCII, for no reason.

I elaborated more in https://news.ycombinator.com/item?id=41389167

ndsipa_pomu• 2 years ago

Hmmm, can't see any mentions of fwknop https://www.cipherdyne.org/fwknop/

Knockknock: Simple, secure, and stealthy port knocking implementation (2012)

Related Stories