5 ms·

Knockknock: Simple, secure, and stealthy port knocking implementation (2012)

90 points by Bluestein 2y ago

ranger_danger 2y ago
this is from 2012, must be run as root, uses python 2, and requires "hping3"
- gawa 2y ago
  It also works only with iptables. And because it's from 2012, it's watching the file /var/log/kern.log [0], which was a simple way to monitor for incoming packets in 2012, but will not work anymore with systemd based distributions nowadays, since all logs are binary and thus accessible through an util such as journalctl. Someone opened a PR to address this [1]. It tries to keep it simple in the spirit of the tool, but it adds another dependency (a systemd python module). I like it overall. The code is so small and simple, it's easy to adapt and to keep small anyway, whatever distro and firewall one might end up use it with. [0] https://github.com/moxie0/knockknock/blob/bf14bbffc5f1d2105cd1d955dabca26b3faa0db4/knockknock-daemon.py#L66 https://github.com/moxie0/knockknock/blob/bf14bbffc5f1d2105c... [1] https://github.com/moxie0/knockknock/pull/7 https://github.com/moxie0/knockknock/pull/7
beeman 2y ago
A similar tool that's actively developed was posted a few days ago. https://news.ycombinator.com/item?id=41327735 https://news.ycombinator.com/item?id=41327735 > Show HN: Ruroco – like port knocking, but better https://github.com/beac0n/ruroco https://github.com/beac0n/ruroco
fooqux 2y ago
I used to use lots of port knocking setups to hide my ssh port. That was, until I discovered Tailscale's SSH setup. Now my SSH is run over wireguard which is very stealthy.
- ray_v 2y ago
  Same. It's amazing not having my server hammered by malicious actors and hardening it by not even offering the ssh service on the primary network interface
  - Demiurge 2y ago
    Why is it so amazing? Sounds more complicated than fail2ban. I've been installing fail2ban for decades on countless servers, using decent passwords, and have never had SSH get brute-forced. It’s anecdotal, but if you’re getting blocked after three wrong attempts, the chances of a successful attack are pretty small. So, why bother with nonstandard ports or even other protocols?
    - tptacek 2y ago
      Getting your SSH brute-forced shouldn't be possible with or without screening, because absolutely nobody in 2024 should be using passwords with SSH to begin with. This is the most frustrating thing about fail2ban cargo culting; fail2ban hasn't made sense since the era of multiuser Unix shell accounts, which is 2 decades in the past.
      - fragmede 2y ago
        You've been mugged in a foreign country and have no phone, no wallet, or keys. How do you break back into your digital life? Everything's got two factor and you've not got your something-you-have factor. I'm all for almost all my servers not accepting passwords, but it's a scenario that I think about, so there's one server running ssh on an non-default port that takes a password so I can break back in using only what's in my head (hopefully I don't get hit so hard in this mugging so as to forget what I've memorized).
        tptacek 2y ago
        This is not a good reason to put passwords on your server SSH accounts. Encrypt an SSH key you can recover.
commercialnix 2y ago
Knockknock was one of my favorite things back in the day. I love Moxie's mindset. Nowadays I put Wireguard in front of everything.
- lfmunoz4 2y ago
  Been wanting to use wireguard but seems like a lot of effort of managing keys and ip addrseses and routing rules etc. Do you have resources that might help me understanding the best setup?
  - fragmede 2y ago
    Tailscale is wireguard underneath and does all that managing for you.
  - commercialnix 2y ago
    When Wireguard first came out I wrote some scripts for myself. Later on I used SaltStack to configure Wireguard for customers with sets of laptops in the dozens or more. https://Netbird.io https://Netbird.io is probably something you may be interested in.
  - dvzk 2y ago
    WireGuard is extremely easy to setup. It's difficult to manage if you have hundreds of nodes or dynamic endpoints: that's what Tailscale and Netmaker helps with. OpenBSD's wg documentation is straightforward. It maps onto wireguard-tools' configuration concepts if you need to use Linux. 1. https://man.openbsd.org/wg.4 https://man.openbsd.org/wg.4 2. https://man.openbsd.org/ifconfig.8#WIREGUARD https://man.openbsd.org/ifconfig.8#WIREGUARD 3. https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8 https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8 With OpenBSD you will typically end up with a hostname.wgN config that looks like this: inet6 fd00:abcd:efgh:ijkl::1/48 wgkey <base64-private-key> wgport 51820 wgpeer <base64-peer-pubkey> \ wgpsk <base64-secret> # optional \ wgaip fd00:abcd:efgh:mnop::1/64 \ wgendpoint x.x.y.y 51820 up
TZubiri 2y ago
Port knocking is supposed to be a last, self made, no dependency, cheap, cute layer of defense. Installing external dependencies, even from someone trusted like Moxie, is counterproductive. The more system you have the more vulnerabilities, less is more. I've actually been fired over this, we were building a product, and I implemented port knocking in python. Lead said it was unsecure and wanted to install an encrypted port knocking protocol. EDIT: Just read the readme, Moxie is saying the same thing verbatim lol, we cool
- teruakohatu 2y ago
  > I've actually been fired over this, Why exactly where you fired? Because you used python?
  - TZubiri 2y ago
    Didn't follow instructions to the T. E.g: install a port knocker vs implementing a port knocker in python
- deleted 2y ago
  [deleted]
andrewstuart 2y ago
Is port knocking really a security thing or is it theater?
- orev 2y ago
  Security is built in layers. Is it theoretically possible for someone on the network to observe the knock sequence? Yes. Is it likely to happen in any but the most adversarial of conditions? No. And if it’s implemented in a cryptographically secure way, like fwknop, then it’s really very good.
  - tptacek 2y ago
    One of the oldest canards in security: "defense in depth", "security is built in layers", which you can use to justify any performative measure.
    - orev 2y ago
      Can you expand on why you think it’s performative?
      - tptacek 2y ago
        Why what's performative? Fail2ban? Because using passwords with SSH is malpractice, and if you aren't, fail2ban literally doesn't do anything.
- tptacek 2y ago
  Pure theater.
- mscdex 2y ago
  In my opinion it's primarily for less noisy logs.
- Joel_Mckay 2y ago
  Prevents some types of distributed slow brute force attack, port scans, and 99.98% of nuisance traffic on the ports. Most effective when interleaved with port-sequence-close and port-trip-wire firewall random-delayed black-hole rules. Note login time window restrictions and fail2ban should also be active. Obfuscating your ssh traffic over SSL or Iodine tunnel traffic can punch through many sandbox networks that try to jack secure traffic. People will argue time constrained tap sequences (think Morse code) are also easily logged with a sniffer, but in general fail2ban rules can email you as the ssh noise should be nearly nonexistent. i.e. One can determine if a route/VPN is attacking secure traffic links, or has uncanny insight into internal security policy. Some people post bad policies for setting up ssh, email, and web servers... Setting up knocking should be the first step on a new server image, as many folks lock themselves out the first run (and on some occasions need to re-image the host). =3
fulafel 2y ago
As a workaround for vulnerabilities in your ssh implementation ("Why Is This Even Necessary") this seems timely given the recent OpenSSH flaw. I wonder if this still works after 12 years of no commits. spiped has been another tool sometimes recommended for addressing this and seems more maintained.
deleted 2y ago
[deleted]
exabrial 2y ago
I mentioned this awhile back: Port Knocking, but the port combination is based on TOTP protocol and has a "use once" feature. Basically rotating protocols :D
thomashabets2 2y ago
Port knocking is a stupid concept. You're sending a password (or TOTP) in plaintext. Just send an UDP packet with the password in it, and be honest about it. Just to prove a point, I made two port knockers using just an UDP packet in a few lines of bash. One uses OpenBSD's signify to sign unlock requests, and the other is on the server side just nftables config to check a static UDP packet, not even a binary. https://github.com/ThomasHabets/udportknock/blob/master/gen-nftables.sh https://github.com/ThomasHabets/udportknock/blob/master/gen-... Modulating TCP SYN packets? Eyeroll.
- Joker_vD 2y ago
  From what I understand, this project does not send a "password": its impossible to replay the requests.
  - thomashabets2 2y ago
    By "this project" you mean OPs link? Sure, many portknocking projects are non-replayable (including the other script in the one I linked to, using OpenBSD's Signify). But what I'm saying is that OTP or not, it's sent in plain text. But "port knocking" is usually this silly modulation over SYN packets. I mean that an OTP sent in plain text is still sent in plain text. Using a series of SYN packets is no more encrypted than just sending it as a UDP packet. SYN modulation is not encryption. Of course non-replayable is better than replayable. I'm not objecting to that. I'm objecting to modulating over SYN packets.
    - Joker_vD 2y ago
      Why is this silly, again? It's indistinguishable from a non-modulated SYN, if that's your concern: the eavesdropper can't even distinguish such port-knocking SYN packets from any other random SYN packet that happened to be routed to the host (there is e.g. a lot of port scanning going on around the Internet). It's encrypted, so even if the eavesdropper could distinguish such a packet, they can't learn the requested port; and they can't even replay this packet, so... what's exactly wrong with it?
ndsipa_pomu 2y ago
Hmmm, can't see any mentions of fwknop https://www.cipherdyne.org/fwknop/ https://www.cipherdyne.org/fwknop/

90 points by Bluestein 2y ago

ranger_danger 2y ago

this is from 2012, must be run as root, uses python 2, and requires "hping3"

gawa 2y ago
It also works only with iptables. And because it's from 2012, it's watching the file /var/log/kern.log [0], which was a simple way to monitor for incoming packets in 2012, but will not work anymore with systemd based distributions nowadays, since all logs are binary and thus accessible through an util such as journalctl. Someone opened a PR to address this [1]. It tries to keep it simple in the spirit of the tool, but it adds another dependency (a systemd python module). I like it overall. The code is so small and simple, it's easy to adapt and to keep small anyway, whatever distro and firewall one might end up use it with. [0] https://github.com/moxie0/knockknock/blob/bf14bbffc5f1d2105cd1d955dabca26b3faa0db4/knockknock-daemon.py#L66 https://github.com/moxie0/knockknock/blob/bf14bbffc5f1d2105c... [1] https://github.com/moxie0/knockknock/pull/7 https://github.com/moxie0/knockknock/pull/7

beeman 2y ago

A similar tool that's actively developed was posted a few days ago. https://news.ycombinator.com/item?id=41327735 https://news.ycombinator.com/item?id=41327735 > Show HN: Ruroco – like port knocking, but better https://github.com/beac0n/ruroco https://github.com/beac0n/ruroco

fooqux 2y ago

I used to use lots of port knocking setups to hide my ssh port. That was, until I discovered Tailscale's SSH setup. Now my SSH is run over wireguard which is very stealthy.

ray_v 2y ago
Same. It's amazing not having my server hammered by malicious actors and hardening it by not even offering the ssh service on the primary network interface
- Demiurge 2y ago
  Why is it so amazing? Sounds more complicated than fail2ban. I've been installing fail2ban for decades on countless servers, using decent passwords, and have never had SSH get brute-forced. It’s anecdotal, but if you’re getting blocked after three wrong attempts, the chances of a successful attack are pretty small. So, why bother with nonstandard ports or even other protocols?
  - tptacek 2y ago
    Getting your SSH brute-forced shouldn't be possible with or without screening, because absolutely nobody in 2024 should be using passwords with SSH to begin with. This is the most frustrating thing about fail2ban cargo culting; fail2ban hasn't made sense since the era of multiuser Unix shell accounts, which is 2 decades in the past.
    - fragmede 2y ago
      You've been mugged in a foreign country and have no phone, no wallet, or keys. How do you break back into your digital life? Everything's got two factor and you've not got your something-you-have factor. I'm all for almost all my servers not accepting passwords, but it's a scenario that I think about, so there's one server running ssh on an non-default port that takes a password so I can break back in using only what's in my head (hopefully I don't get hit so hard in this mugging so as to forget what I've memorized).
      - tptacek 2y ago
        This is not a good reason to put passwords on your server SSH accounts. Encrypt an SSH key you can recover.

commercialnix 2y ago

Knockknock was one of my favorite things back in the day. I love Moxie's mindset. Nowadays I put Wireguard in front of everything.

lfmunoz4 2y ago
Been wanting to use wireguard but seems like a lot of effort of managing keys and ip addrseses and routing rules etc. Do you have resources that might help me understanding the best setup?
- fragmede 2y ago
  Tailscale is wireguard underneath and does all that managing for you.
- commercialnix 2y ago
  When Wireguard first came out I wrote some scripts for myself. Later on I used SaltStack to configure Wireguard for customers with sets of laptops in the dozens or more. https://Netbird.io https://Netbird.io is probably something you may be interested in.
- dvzk 2y ago
  WireGuard is extremely easy to setup. It's difficult to manage if you have hundreds of nodes or dynamic endpoints: that's what Tailscale and Netmaker helps with. OpenBSD's wg documentation is straightforward. It maps onto wireguard-tools' configuration concepts if you need to use Linux. 1. https://man.openbsd.org/wg.4 https://man.openbsd.org/wg.4 2. https://man.openbsd.org/ifconfig.8#WIREGUARD https://man.openbsd.org/ifconfig.8#WIREGUARD 3. https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8 https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8 With OpenBSD you will typically end up with a hostname.wgN config that looks like this: inet6 fd00:abcd:efgh:ijkl::1/48 wgkey <base64-private-key> wgport 51820 wgpeer <base64-peer-pubkey> \ wgpsk <base64-secret> # optional \ wgaip fd00:abcd:efgh:mnop::1/64 \ wgendpoint x.x.y.y 51820 up

TZubiri 2y ago

Port knocking is supposed to be a last, self made, no dependency, cheap, cute layer of defense. Installing external dependencies, even from someone trusted like Moxie, is counterproductive. The more system you have the more vulnerabilities, less is more. I've actually been fired over this, we were building a product, and I implemented port knocking in python. Lead said it was unsecure and wanted to install an encrypted port knocking protocol. EDIT: Just read the readme, Moxie is saying the same thing verbatim lol, we cool

teruakohatu 2y ago
> I've actually been fired over this, Why exactly where you fired? Because you used python?
- TZubiri 2y ago
  Didn't follow instructions to the T. E.g: install a port knocker vs implementing a port knocker in python
deleted 2y ago
[deleted]

andrewstuart 2y ago

Is port knocking really a security thing or is it theater?

orev 2y ago
Security is built in layers. Is it theoretically possible for someone on the network to observe the knock sequence? Yes. Is it likely to happen in any but the most adversarial of conditions? No. And if it’s implemented in a cryptographically secure way, like fwknop, then it’s really very good.
- tptacek 2y ago
  One of the oldest canards in security: "defense in depth", "security is built in layers", which you can use to justify any performative measure.
  - orev 2y ago
    Can you expand on why you think it’s performative?
    - tptacek 2y ago
      Why what's performative? Fail2ban? Because using passwords with SSH is malpractice, and if you aren't, fail2ban literally doesn't do anything.
tptacek 2y ago
Pure theater.
mscdex 2y ago
In my opinion it's primarily for less noisy logs.
Joel_Mckay 2y ago
Prevents some types of distributed slow brute force attack, port scans, and 99.98% of nuisance traffic on the ports. Most effective when interleaved with port-sequence-close and port-trip-wire firewall random-delayed black-hole rules. Note login time window restrictions and fail2ban should also be active. Obfuscating your ssh traffic over SSL or Iodine tunnel traffic can punch through many sandbox networks that try to jack secure traffic. People will argue time constrained tap sequences (think Morse code) are also easily logged with a sniffer, but in general fail2ban rules can email you as the ssh noise should be nearly nonexistent. i.e. One can determine if a route/VPN is attacking secure traffic links, or has uncanny insight into internal security policy. Some people post bad policies for setting up ssh, email, and web servers... Setting up knocking should be the first step on a new server image, as many folks lock themselves out the first run (and on some occasions need to re-image the host). =3

fulafel 2y ago

As a workaround for vulnerabilities in your ssh implementation ("Why Is This Even Necessary") this seems timely given the recent OpenSSH flaw. I wonder if this still works after 12 years of no commits. spiped has been another tool sometimes recommended for addressing this and seems more maintained.

deleted 2y ago

[deleted]

exabrial 2y ago

I mentioned this awhile back: Port Knocking, but the port combination is based on TOTP protocol and has a "use once" feature. Basically rotating protocols :D

thomashabets2 2y ago

Port knocking is a stupid concept. You're sending a password (or TOTP) in plaintext. Just send an UDP packet with the password in it, and be honest about it. Just to prove a point, I made two port knockers using just an UDP packet in a few lines of bash. One uses OpenBSD's signify to sign unlock requests, and the other is on the server side just nftables config to check a static UDP packet, not even a binary. https://github.com/ThomasHabets/udportknock/blob/master/gen-nftables.sh https://github.com/ThomasHabets/udportknock/blob/master/gen-... Modulating TCP SYN packets? Eyeroll.

Joker_vD 2y ago
From what I understand, this project does not send a "password": its impossible to replay the requests.
- thomashabets2 2y ago
  By "this project" you mean OPs link? Sure, many portknocking projects are non-replayable (including the other script in the one I linked to, using OpenBSD's Signify). But what I'm saying is that OTP or not, it's sent in plain text. But "port knocking" is usually this silly modulation over SYN packets. I mean that an OTP sent in plain text is still sent in plain text. Using a series of SYN packets is no more encrypted than just sending it as a UDP packet. SYN modulation is not encryption. Of course non-replayable is better than replayable. I'm not objecting to that. I'm objecting to modulating over SYN packets.
  - Joker_vD 2y ago
    Why is this silly, again? It's indistinguishable from a non-modulated SYN, if that's your concern: the eavesdropper can't even distinguish such port-knocking SYN packets from any other random SYN packet that happened to be routed to the host (there is e.g. a lot of port scanning going on around the Internet). It's encrypted, so even if the eavesdropper could distinguish such a packet, they can't learn the requested port; and they can't even replay this packet, so... what's exactly wrong with it?

ndsipa_pomu 2y ago

Hmmm, can't see any mentions of fwknop https://www.cipherdyne.org/fwknop/ https://www.cipherdyne.org/fwknop/