4 ms·

I wrote a little utility to keep ssh ports off unless a totp packet is sent to a UDP port. I haven't worked on it much since the initial proof of concept. There

I wrote a little utility to keep ssh ports off unless a totp packet is sent to a UDP port. I haven't worked on it much since the initial proof of concept. There are several things that could be done to improve it (open only for the address that sent the packet, symmetric key for safer secret distribution, etc). Shared key would involve encrypting time and only open if the decrypted time matches current. The totp packet is a full hash of time + shared code so brute force is completely infeasible. It's currently in python, it would be much better in something like go with daemon monitoring. It is very simple, and it practically eliminates attempts. If it became widely known there would probably be attempts on the udp port. An additional improvement would be randomize the listening port based on the time+hash: https://dhj.io/posts/2017/05/16/totp-knock/ https://dhj.io/posts/2017/05/16/totp-knock/

finnthehuman 9y ago
In case you were unaware and didn't just want to write your own, fwknop is an off the shelf tool to do the same. http://www.cipherdyne.org/fwknop/ http://www.cipherdyne.org/fwknop/
- daveguy 9y ago
  I appreciate the reference. I looked at that before starting and reference it in the blog post (but should probably include a direct link to the software rather than the original concept post and article that include links). The similarities are they both use a single packet and they are both an improvement on port knocking. This is a simpler solution (pairing UDP with TOTP). No TCP connection is required. Making it ip address specific would prevent replay attacks (although even without address specific the replay would only be valid for ~30s). Another benefit is that a port scan will reveal no ports open (because it is a one-way UDP based protocol). fwknop is definitely a polished solution where this is just a proof of concept for the TOTP/UDP as a shared key knock. Thank you for the feedback! EDIT: I updated the post to include a direct link to fwknop rather than just links to the posts/articles about it.

finnthehuman 9y ago

In case you were unaware and didn't just want to write your own, fwknop is an off the shelf tool to do the same. http://www.cipherdyne.org/fwknop/ http://www.cipherdyne.org/fwknop/

daveguy 9y ago
I appreciate the reference. I looked at that before starting and reference it in the blog post (but should probably include a direct link to the software rather than the original concept post and article that include links). The similarities are they both use a single packet and they are both an improvement on port knocking. This is a simpler solution (pairing UDP with TOTP). No TCP connection is required. Making it ip address specific would prevent replay attacks (although even without address specific the replay would only be valid for ~30s). Another benefit is that a port scan will reveal no ports open (because it is a one-way UDP based protocol). fwknop is definitely a polished solution where this is just a proof of concept for the TOTP/UDP as a shared key knock. Thank you for the feedback! EDIT: I updated the post to include a direct link to fwknop rather than just links to the posts/articles about it.