3 ms·

Why not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you cl

Why not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you clearly already have ssh.

cynicalkane 2mo ago
That's a good idea, but on the other hand, it seems inappropriate to use such lore in the manner of a lore-master in these suspicious days; not a fitting reference for the happier times of Durin.
nine_k 2mo ago
It's easier as in using already known tools. It's potentially less secure because sshd is vastly more complex, and allows literal (authorized) remote code execution, unlike fwknop.
- jauntywundrkind 2mo ago
  You would absolutely not use openssh server for this. That's a terrible idea. Pick a library. https://github.com/Eugeny/russh https://github.com/Eugeny/russh
notpushkin 2mo ago
Why even type anything? Just ssh to 7000, and use the same public key to authenticate. The server responds with “You’re in”, opens up 22 and closes the connection. You then ssh normally. This bespoke server should not advertise it in any special way though (generic OpenSSH banner), and can be used to also ban port scanners if they try to do something fishy. fwknop is impossible to even scan for, though, so it’s a bit more robust in that sense.
jauntywundrkind 2mo ago
I threw an example together with Sol: Knoxbox https://github.com/rektide/knoxbox https://github.com/rektide/knoxbox It assumes systemd, which it uses to start sshd. It also restarts a systemd timer to shut sshd down in 5m. Ssh is set up (by defualt on Debian) to have KillMode=process, leaving the client instances alive, just killing the listen server. I tend to agree with the top post. I've never felt that knock servers really deserve consideration. That said, the way that this knock server is so small, makes use of well known parts of the system as it is (systemd), is so low risk, and built around decent security building blocks (recursively) & not some ad-hoc protocol is kind of interesting and fun. This one is pretty easy to visualize.

Why not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you clearly already have ssh.

cynicalkane 2mo ago

That's a good idea, but on the other hand, it seems inappropriate to use such lore in the manner of a lore-master in these suspicious days; not a fitting reference for the happier times of Durin.

nine_k 2mo ago

It's easier as in using already known tools. It's potentially less secure because sshd is vastly more complex, and allows literal (authorized) remote code execution, unlike fwknop.

jauntywundrkind 2mo ago
You would absolutely not use openssh server for this. That's a terrible idea. Pick a library. https://github.com/Eugeny/russh https://github.com/Eugeny/russh

notpushkin 2mo ago

Why even type anything? Just ssh to 7000, and use the same public key to authenticate. The server responds with “You’re in”, opens up 22 and closes the connection. You then ssh normally. This bespoke server should not advertise it in any special way though (generic OpenSSH banner), and can be used to also ban port scanners if they try to do something fishy. fwknop is impossible to even scan for, though, so it’s a bit more robust in that sense.

jauntywundrkind 2mo ago

I threw an example together with Sol: Knoxbox https://github.com/rektide/knoxbox https://github.com/rektide/knoxbox It assumes systemd, which it uses to start sshd. It also restarts a systemd timer to shut sshd down in 5m. Ssh is set up (by defualt on Debian) to have KillMode=process, leaving the client instances alive, just killing the listen server. I tend to agree with the top post. I've never felt that knock servers really deserve consideration. That said, the way that this knock server is so small, makes use of well known parts of the system as it is (systemd), is so low risk, and built around decent security building blocks (recursively) & not some ad-hoc protocol is kind of interesting and fun. This one is pretty easy to visualize.