3 ms·
My default ipfw ruleset is very restrictive - no ports open. The command that gets run when the (correct) knock comes in is an ipfw command: /sbin/ipfw add
by rsync 6y ago
My default ipfw ruleset is very restrictive - no ports open.
The command that gets run when the (correct) knock comes in is an ipfw command:
/sbin/ipfw add 01021 allow tcp from %IP% to 10.0.0.10 22,443 setup
... so now the knocking IP can see TCP 22 and 443 (and nothing else).
I then have a cron job that runs every night at midnight that deletes those rules:
0 0 * * * /sbin/ipfw delete 01021
... so I am required to knock daily.
The following is a little lame, but I want to see who has knocked so far today (should just be me and my own IPs) so I do this every minute:
* * * * * /sbin/ipfw show|/usr/bin/grep ^01021 | awk '{print $7}' > /tmp/.knock_list
... and then cat that list to myself every time I log in ...
- polishdude20 6y agoSo with poet knocking, if I only have an ssh port open and a couple of ports my servers server content on like an http and https server, I'm assuming id use port knocking to get inside my ssh port right? I don't need to do port knocking for my http and https ports because they're open but not as an ssh service?
- TedDoesntTalk 6y ago> So with poet knocking Knocking a poet is bound to get you into trouble. Poets fight back, and hard. Just don't do it.
- polishdude20 6y agoBut they're just so damn eloquent all the time. It drives me nuts.
- rsync 6y agoYes, that's right - you'd leave your public services open by default and the knock would simply open up tcp22 ...