4 ms·

> Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. Indeed: I whitelist hosts/IP blocks allowed t

> Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. Indeed: I whitelist hosts/IP blocks allowed to SSH in. I don't use port-knocking but I never ever criticized those using port knocking. I do really wonder if people are still going to say that port knocking is pointless and security theatre: we now have a clear example where people who were using port-knocking were protected while those who didn't were potentially wide open to the biggest backdoor discovered to date (even if it's wasn't yet in all the major distros). > ... does the entire internet really need to be able to SSH to your box? Nope and I never ever understood the argument saying: "Port-knocking is security theatre, it doesn't bring any added security". To me port-knocking didn't lower the security of a system. It seems that we now have a clear proof that it's actually helping versus certain type of attacks (including source-code supply chain attacks).

AlexCoventry 3y ago
> say that port knocking is pointless and security theatre Who was saying that?
- password4321 3y ago
  https://hn.algolia.com/?query=port%20knocking%20obscurity&type=comment https://hn.algolia.com/?query=port%20knocking%20obscurity&ty... 20200515 https://news.ycombinator.com/item?id=23187662 https://news.ycombinator.com/item?id=23187662 etc.
  - AlexCoventry 3y ago
    Thanks.
- rdtsc 3y ago
  I've heard it many times in the form of "security through obscurity, lol! you obviously, don't know what you're doing". Yeah, it's a "straw man" pretending the person they are addressing was just planning on running telnet with port knocking.
bpfrh 3y ago
>It seems that we now have a clear proof that it's actually helping versus certain type of attacks (including source-code supply chain attacks). So would have a vpn or using a bastion host with a custom non standard ssh implementation... At some point you have to make the choice to not implement a security measure and I would argue that should stop at vpn+standard software for secure access. If you are a bigger company, probably add SSO and network segmentation with bastion hosts and good logging. Port Knocking doesn't add any security benefit in the sense that there are known non avoidable security risk aka your transmit your password(knocking) in clear text over the network. You also add another program with potential vulnerabilities, and as port knocking is not as popular as e.g. sshd, wireguard, maybe it gets less scrutiny and it leads to a supply chain attack? Security measures are also not free in the sense that somebody has to distribute them and keep the configuration up to date, even if that person is you, that means syncing that connect-to-server-script and keeping it in a secure location on your devices.
- tredre3 3y ago
  You also add another program with potential vulnerabilities, and as port knocking is not as popular as e.g. sshd, wireguard, maybe it gets less scrutiny and it leads to a supply chain attack? That other program is just a stateful firewall, aka the Linux Kernel itself. If you can't trust your kernel then nothing you do matters.
  - bpfrh 3y ago
    That other programm is knockd, which needs to listen to all traffic and look for the specified packets. Granted, that program is really small and could be easily audited, but that same time could have been spent on trying apparmor/seclinux + a good vpn and 2fa
    - rhaps0dy 3y ago
      I much prefer the approach I read about in https://github.com/moxie0/knockknock https://github.com/moxie0/knockknock (use a safe language, trust basically only the program you write and the language), to a random port daemon written in C which pulls libpcap to sniff everything. To some extent knockknock also trusts the Python interpreter which is not ideal (but maybe OK)
nick238 3y ago
The advantage of port knocking to me is just reducing the amount of garbage script-kiddie scans. IMHO the design of `sshd` needs to just assume it will be slammed by garbage attempts and minimize the logging. I've heard of `fail2ban`, but banning does nothing as the bots have an unlimited number of IPs.

AlexCoventry 3y ago

> say that port knocking is pointless and security theatre Who was saying that?

password4321 3y ago
https://hn.algolia.com/?query=port%20knocking%20obscurity&type=comment https://hn.algolia.com/?query=port%20knocking%20obscurity&ty... 20200515 https://news.ycombinator.com/item?id=23187662 https://news.ycombinator.com/item?id=23187662 etc.
- AlexCoventry 3y ago
  Thanks.
rdtsc 3y ago
I've heard it many times in the form of "security through obscurity, lol! you obviously, don't know what you're doing". Yeah, it's a "straw man" pretending the person they are addressing was just planning on running telnet with port knocking.

bpfrh 3y ago

>It seems that we now have a clear proof that it's actually helping versus certain type of attacks (including source-code supply chain attacks). So would have a vpn or using a bastion host with a custom non standard ssh implementation... At some point you have to make the choice to not implement a security measure and I would argue that should stop at vpn+standard software for secure access. If you are a bigger company, probably add SSO and network segmentation with bastion hosts and good logging. Port Knocking doesn't add any security benefit in the sense that there are known non avoidable security risk aka your transmit your password(knocking) in clear text over the network. You also add another program with potential vulnerabilities, and as port knocking is not as popular as e.g. sshd, wireguard, maybe it gets less scrutiny and it leads to a supply chain attack? Security measures are also not free in the sense that somebody has to distribute them and keep the configuration up to date, even if that person is you, that means syncing that connect-to-server-script and keeping it in a secure location on your devices.

tredre3 3y ago
You also add another program with potential vulnerabilities, and as port knocking is not as popular as e.g. sshd, wireguard, maybe it gets less scrutiny and it leads to a supply chain attack? That other program is just a stateful firewall, aka the Linux Kernel itself. If you can't trust your kernel then nothing you do matters.
- bpfrh 3y ago
  That other programm is knockd, which needs to listen to all traffic and look for the specified packets. Granted, that program is really small and could be easily audited, but that same time could have been spent on trying apparmor/seclinux + a good vpn and 2fa
  - rhaps0dy 3y ago
    I much prefer the approach I read about in https://github.com/moxie0/knockknock https://github.com/moxie0/knockknock (use a safe language, trust basically only the program you write and the language), to a random port daemon written in C which pulls libpcap to sniff everything. To some extent knockknock also trusts the Python interpreter which is not ideal (but maybe OK)

nick238 3y ago

The advantage of port knocking to me is just reducing the amount of garbage script-kiddie scans. IMHO the design of `sshd` needs to just assume it will be slammed by garbage attempts and minimize the logging. I've heard of `fail2ban`, but banning does nothing as the bots have an unlimited number of IPs.