3 ms·
Port-knocking is a PITA in theory and even worse in real world : people do not have time nor the will to do wild invocations before getting job done. Unless yo
by JackSlateur 2y ago
Port-knocking is a PITA in theory and even worse in real world : people do not have time nor the will to do wild invocations before getting job done.
Unless you are talking about your own personal use-case, in which case, feel free to follow your deepest wishes
Firewall is a joke, too. Who can manage hundreds and thousands of even-changing IP ? Nobody. Again: I'm not talking about your personal use-case (yet I enjoy connecting to my server through 4G, whereever I am)
Fail2ban, on the other hand, is nice: every systems that relies on some known secret benefits from an anti-bruteforce mechanism. Also, and this is important: fail2ban is quick to deploy, and not a PITA for users. Good stuff.
- fullspectrumdev 2y agoI’ve written a few toy port knocking implementations, and doing it right is hard. If your connections crap and there’s packet loss, some of the sequence may be lost. Avoiding replay attacks is another whole problem - you want the sequence to change based on a shared secret and time or something similar (eg: TOTP to agree the sequence). Then you have to consider things like NAT…
- dspillett 2y agoAlso, if you are trying to connect to a resource from a restrictive network your knocking sequence might be blocked by filters at the client end. I've been on networks that allow nothing except the standard TCP & UDP ports for HTTP(S), SSH and DNS (and even then DNS was restricted to their local name server).
- password4321 2y agoI am interested in any tools for managing IP allow lists on Azure and AWS. It seems like there should be something fairly polished, perhaps with an enrollment flow for self-management and a few reports/warnings...