4 ms·
If someone intercepts the traffic to my server, they could see the knock sequence and re-use it. Is there any way to get knockd to use a google authenticator-li
by geoffeg 6y ago
If someone intercepts the traffic to my server, they could see the knock sequence and re-use it. Is there any way to get knockd to use a google authenticator-like sequence of port knocks?
- thedanbob 6y agoI use fwknop[0] on my servers. It does single-packet authorization rather than straight port knocking, which solves the replay issue. [0] https://www.cipherdyne.org/fwknop/ https://www.cipherdyne.org/fwknop/
- cortesoft 6y agoYou block a MITM attack with public key cryptography. Port knocking is not meant to stop MITM attacks.
- magicconch 6y agoYes, take a look at the manual page for knockd and search for "One_Time_Sequences". It does what you are asking by using a one-time valid sequence of port knocks, but it is like HOTP rather than TOTP.