5 ms·
What benefit does port knocking add to having a key auth only setup?
by lkurusa 8y ago
What benefit does port knocking add to having a key auth only setup?
- asmithmd1 8y agoWhat benefit does locking the glass doors into a bank add to having time-locked vault? Defense in depth.
- s3m4j 8y agoA port knock is just a clear password :/ I much prefer restricting port 22 to a few ip and disable passwords
- lakechfoma 8y agoNot with single packet authentication from fwknop http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#what-is-SPA http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#w...
- Operyl 8y agofwknop has a cache to prevent replay attacks, that plus the fact the packets are only valid for a certain length of time pretty much thwarts this. Remember, fwknop is _in addition_ to your existing security practices, it is not the only "password."
- rsync 8y ago"A port knock is just a clear password" It is only clear to the routers in your traceroute ... third party attackers cannot snoop on this traffic.
- sliken 8y agoRight, exactly like a clear text password.
- ryanlol 8y agoThe vault and the locked glass doors defend against entirely different things. Same doesn’t really apply for ssh keys and port knocking.
- petercooper 8y agoIf it's set up properly, it could mean you don't have log files filled with login attempts since the SSH port won't open to them until a successful knock and the knocking doesn't have to be logged. While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks. An attacker dedicated to getting into your specific server is another matter but thankfully far more rare.
- rsync 8y ago"While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks." Thank you. Remember - security through only obscurity is a bad idea, but additional layers of obscurity can be very valuable. Also remember: a typical port knock is a series of three ports that all have to be hit in a certain timeframe - for instance, 2000, 4000, 8000 - that's a big "keyspace" to brute force through at WAN packet speeds ...
- AlexCoventry 8y agoIdeally, your port-knocking service is much simpler and easier to audit than your ssh service. It's also much more obscure. So you have a service which is very unlikely to suffer a 0-day vulnerability listening all the time to engage a much more vulnerable service only at those exact times you need it.