5 ms·

I'm surprised port knocking never really caught on. Does anyone know of it being used in production anywhere?

weare138 6y ago
I'm guess because VPN's and SSH became so ubiquitous? Having a single point of entry, especially when combined with 2FA, is probably good enough for most situations.
e12e 6y ago
It's generally more convoluted than the equivalent alternatives, with less features. You need a shared secret - you could use totp - or you could use vpn/ssh with key based auth - both offer authentication of/to both sides and encryption/confidentiality. Blocking all icmp traffic breaks tcp - so true "invisibility" isn't that grät either.
wrnr 6y ago
I can neither confirm nor deny
DiffEq 6y ago
Well kind in the theme of port knocking Postfix has a Grey Listing option which kind of works like that for spam though not the same thing.
jonfw 6y ago
port knocking is just, another way of doing a password, right? It's pretty much just a PIN code with a slightly obscure method of inputting the digits. I would imagine that this is open for a man in the middle attack- if this traffic were intercepted- you'd be able to see port numbers, right?
- outworlder 6y ago
  Well, yes. But where would the attacker be if they are in a position to intercept the traffic? The answer to that may dictate if the technique would have value for you.
  - jonfw 6y ago
    I'm just saying that port knocking just results in another secret you have to manage. It's just adding another locked door. Why use a locked door that's a pain in the ass and insecure in transit? If you want two layers of secret-based auth- why would you make your second layer one that's objectively less secure and more unwieldy than other layers?
- dec0dedab0de 6y ago
  if this traffic were intercepted- you'd be able to see port numbers, right? Sure but I hope the service you're opening up with the knock is actually secure like ssh. The idea is just that you cant portscan to find something to attack. Its basically the same reasoning behind using non standard ports, but takes it a bit further.
  - jonfw 6y ago
    The non-standard port is of trivial value, but it's practically zero cost- that's why it's used. Port knocking doesn't have that benefit- you're establishing another secret that has to be maintained and accessed- but unlike key based auth or passwords- that secret is insecure in transit and unwieldy to use. If you want to add another layer and manage another secret- why not just add another layer of the lower-friction and more secure methods we already use to establish secret-based auth?
    - TillE 6y ago
      Which comes all the way around to: a VPN sounds like a better option in every respect. More secure, universally supported. I think the main reason you'd use port knocking is because it's fun and cool.
ThA0x2 6y ago
Worked for a major bank (think top 10). We had port knocking on several publicly accessible infrastructure pieces (LBs, some VMs, etc.) Decades of running without a single intrusion. We moved to SPA port knocking and now we rely less on the VPN for certain assets.
cthalupa 6y ago
For production use cases in a business environment it's just not as good as the alternatives. Setting up VPNs and blocking SSH access to the internet is just as easy, less overhead, and more secure. Let's say you're a bank. You implement port knocking as your security measure of choice to keep SSH secure. I know from your job postings that your developers and IT department work at X location in Y city. I know the IP range of your public facing servers. I go to the closest coffee shops to that office, and drop off some wifi sniffers that record and send me all the communication to that IP range. All it takes is one of your employees doing some work on one of those servers from the coffee shop, and now I know your port knock sequence. Layer defeated. Or, you use a VPN. I do the same thing. All I see is VPN traffic. Maybe I can identify what type of traffic with DPI (unlikely to have the horsepower on the type of device you'd be leaving unattended at/near coffee shops for extended periods of time), but no real details on where that traffic is ultimately headed, and I have no ingress point given up to me. The VPN can also be used to secure other types of traffic beyond SSH. There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive.
- dec0dedab0de 6y ago
  There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive. But I would say in addition to a VPN, not instead of. Imagine the vpn client had it built in to do the knock, before connecting. So the VPN ports are not opened until the knock is performed and only for the source IP that did them.
  - cthalupa 6y ago
    I mean, you could - it's not going to make things less secure to add port knocking - but I don't know that it makes things significantly more secure. The chances of there being public 0day exploits for a VPN and SSHD at the same time is pretty much zero, especially if you add in additional layers such as 2FA (which I would recommend doing) If someone is burning multiple private 0day exploits to target you then they are attackers at the level where port knocking is not likely to foil them either. (And to be clear, I just think that port knocking is a bit silly - not that it's totally ineffective, and it's not what I would call security through obscurity, since it is effectively another auth factor with a simple PIN)

I'm guess because VPN's and SSH became so ubiquitous? Having a single point of entry, especially when combined with 2FA, is probably good enough for most situations.

e12e 6y ago

It's generally more convoluted than the equivalent alternatives, with less features. You need a shared secret - you could use totp - or you could use vpn/ssh with key based auth - both offer authentication of/to both sides and encryption/confidentiality. Blocking all icmp traffic breaks tcp - so true "invisibility" isn't that grät either.

wrnr 6y ago

I can neither confirm nor deny

DiffEq 6y ago

Well kind in the theme of port knocking Postfix has a Grey Listing option which kind of works like that for spam though not the same thing.

jonfw 6y ago

port knocking is just, another way of doing a password, right? It's pretty much just a PIN code with a slightly obscure method of inputting the digits. I would imagine that this is open for a man in the middle attack- if this traffic were intercepted- you'd be able to see port numbers, right?

outworlder 6y ago
Well, yes. But where would the attacker be if they are in a position to intercept the traffic? The answer to that may dictate if the technique would have value for you.
- jonfw 6y ago
  I'm just saying that port knocking just results in another secret you have to manage. It's just adding another locked door. Why use a locked door that's a pain in the ass and insecure in transit? If you want two layers of secret-based auth- why would you make your second layer one that's objectively less secure and more unwieldy than other layers?
dec0dedab0de 6y ago
if this traffic were intercepted- you'd be able to see port numbers, right? Sure but I hope the service you're opening up with the knock is actually secure like ssh. The idea is just that you cant portscan to find something to attack. Its basically the same reasoning behind using non standard ports, but takes it a bit further.
- jonfw 6y ago
  The non-standard port is of trivial value, but it's practically zero cost- that's why it's used. Port knocking doesn't have that benefit- you're establishing another secret that has to be maintained and accessed- but unlike key based auth or passwords- that secret is insecure in transit and unwieldy to use. If you want to add another layer and manage another secret- why not just add another layer of the lower-friction and more secure methods we already use to establish secret-based auth?
  - TillE 6y ago
    Which comes all the way around to: a VPN sounds like a better option in every respect. More secure, universally supported. I think the main reason you'd use port knocking is because it's fun and cool.

ThA0x2 6y ago

Worked for a major bank (think top 10). We had port knocking on several publicly accessible infrastructure pieces (LBs, some VMs, etc.) Decades of running without a single intrusion. We moved to SPA port knocking and now we rely less on the VPN for certain assets.

cthalupa 6y ago

For production use cases in a business environment it's just not as good as the alternatives. Setting up VPNs and blocking SSH access to the internet is just as easy, less overhead, and more secure. Let's say you're a bank. You implement port knocking as your security measure of choice to keep SSH secure. I know from your job postings that your developers and IT department work at X location in Y city. I know the IP range of your public facing servers. I go to the closest coffee shops to that office, and drop off some wifi sniffers that record and send me all the communication to that IP range. All it takes is one of your employees doing some work on one of those servers from the coffee shop, and now I know your port knock sequence. Layer defeated. Or, you use a VPN. I do the same thing. All I see is VPN traffic. Maybe I can identify what type of traffic with DPI (unlikely to have the horsepower on the type of device you'd be leaving unattended at/near coffee shops for extended periods of time), but no real details on where that traffic is ultimately headed, and I have no ingress point given up to me. The VPN can also be used to secure other types of traffic beyond SSH. There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive.

dec0dedab0de 6y ago
There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive. But I would say in addition to a VPN, not instead of. Imagine the vpn client had it built in to do the knock, before connecting. So the VPN ports are not opened until the knock is performed and only for the source IP that did them.
- cthalupa 6y ago
  I mean, you could - it's not going to make things less secure to add port knocking - but I don't know that it makes things significantly more secure. The chances of there being public 0day exploits for a VPN and SSHD at the same time is pretty much zero, especially if you add in additional layers such as 2FA (which I would recommend doing) If someone is burning multiple private 0day exploits to target you then they are attackers at the level where port knocking is not likely to foil them either. (And to be clear, I just think that port knocking is a bit silly - not that it's totally ineffective, and it's not what I would call security through obscurity, since it is effectively another auth factor with a simple PIN)