5 ms·

Jumphosts have their uses, but in this case, I really don't see it. As others have pointed out, better yet is VPN only access. As for the port knocking silline

Jumphosts have their uses, but in this case, I really don't see it. As others have pointed out, better yet is VPN only access. As for the port knocking silliness, well, I don't see any reason for it. http://bsdly.blogspot.com/2012/04/why-not-use-port-knocking.html http://bsdly.blogspot.com/2012/04/why-not-use-port-knocking....

akerl_ 12y ago
It's worth noting that single packet auth is distinct from port knocking. fwknop isn't relying on "secret" port combinations: it's using GPG to sign/encrypt requests.
- cthalupa 12y ago
  It's not meaningfully different - most of the same flaws still apply. Say you have a bad actor behind the same NAT'ed IP. Good User A signs their SPA, and the firewall opens up for 30 seconds... during which Malicious User B has access. What real advantage are you gaining vs. just having restricted firewall rules in the first place? Lowering the window of time an attacker has access? If you're not using password auth that could be brute forced, who cares about the window? Either they have the keys or an exploit needed to get in, or they don't.
  - sophacles 12y ago
    The advantage over vanilla restrictive firewalls is ability to come from many different IPs without cluttering logs. In an enterprise setting, this is probably not helpful. At home or for private servers, this is a nice feature. (Also at home, it helps reduce stupid ISP imposed rules on not hosting ssh... their scanners just assume "no server here" but I can still get to my home network)
rsync 12y ago
I've been doing this sysadmin thing for a long, long time, and have built some large, high profile platforms,[1][2] and I can tell you that few things have made me happier than port knocking. Yes, it is a password with a tiny number of "bits". But nobody suggested using only port knocking, so that's not significant. Yes, if my attacker is sharing the exact same NAT'd IP as me then they have a window to attack ... my fully hardened server, which was no worse than what was presented to them before. Finally (and this is what makes me happiest) my sshd is not exposed to whatever new exploit might be discovered tomorrow that doesn't require user credentials. It's not exposed to being DOS'd by a buffer overflow vuln. It's not filling my logs with brute forcers all day and night. I love port knocking. [1] JohnCompanies (first VPS provider) [2] rsync.net
- philjr 12y ago
  just run ssh on a non-standard port and you get the same benefits
  - arde 12y ago
    That is equivalent to limiting SPA to a 16-bit password.
  - e40 12y ago
    just run ssh on a non-standard port and you get the same benefits philjr, that is just complete BS. I've run SSH on non-standard ports and they still get a lot of attempts. You know, there are these things called port scans that easily find the daemon on alternate ports.
- peterwwillis 12y ago
  Mr. Sysadmin, I have four questions: 1. When was the last time your sshd was hit with a 0day? 2. Why aren't you running grsec to prevent buffer overflows (amongst other things) ? 3. Wouldn't it be easier to DOS your host with excess traffic (like all modern DDOS attacks), rather than find a remote-code-execution buffer overflow 0day and use it solely to starve resources on a bastion host? 4. Why don't you use a VPN? If you used a udp-based VPN nobody would even know the port was open (connectionless) and you could even require a preshared key, which is the more secure equivalent of port knocking.
  - arde 12y ago
    Regarding item 4, a VPN solution is considerably more complex and error prone than port knocking plus SSH. What do you do if/when your VPN service fails? I think you would usually have a VPN service AND a port knocked SSH backdoor.
    - peterwwillis 12y ago
      Yes, good security is usually more complex, though error prone I don't think is accurate. What do you do when your SSH or port knocking service fails?

akerl_ 12y ago

It's worth noting that single packet auth is distinct from port knocking. fwknop isn't relying on "secret" port combinations: it's using GPG to sign/encrypt requests.

cthalupa 12y ago
It's not meaningfully different - most of the same flaws still apply. Say you have a bad actor behind the same NAT'ed IP. Good User A signs their SPA, and the firewall opens up for 30 seconds... during which Malicious User B has access. What real advantage are you gaining vs. just having restricted firewall rules in the first place? Lowering the window of time an attacker has access? If you're not using password auth that could be brute forced, who cares about the window? Either they have the keys or an exploit needed to get in, or they don't.
- sophacles 12y ago
  The advantage over vanilla restrictive firewalls is ability to come from many different IPs without cluttering logs. In an enterprise setting, this is probably not helpful. At home or for private servers, this is a nice feature. (Also at home, it helps reduce stupid ISP imposed rules on not hosting ssh... their scanners just assume "no server here" but I can still get to my home network)

rsync 12y ago

I've been doing this sysadmin thing for a long, long time, and have built some large, high profile platforms,[1][2] and I can tell you that few things have made me happier than port knocking. Yes, it is a password with a tiny number of "bits". But nobody suggested using only port knocking, so that's not significant. Yes, if my attacker is sharing the exact same NAT'd IP as me then they have a window to attack ... my fully hardened server, which was no worse than what was presented to them before. Finally (and this is what makes me happiest) my sshd is not exposed to whatever new exploit might be discovered tomorrow that doesn't require user credentials. It's not exposed to being DOS'd by a buffer overflow vuln. It's not filling my logs with brute forcers all day and night. I love port knocking. [1] JohnCompanies (first VPS provider) [2] rsync.net

philjr 12y ago
just run ssh on a non-standard port and you get the same benefits
- arde 12y ago
  That is equivalent to limiting SPA to a 16-bit password.
- e40 12y ago
  just run ssh on a non-standard port and you get the same benefits philjr, that is just complete BS. I've run SSH on non-standard ports and they still get a lot of attempts. You know, there are these things called port scans that easily find the daemon on alternate ports.
peterwwillis 12y ago
Mr. Sysadmin, I have four questions: 1. When was the last time your sshd was hit with a 0day? 2. Why aren't you running grsec to prevent buffer overflows (amongst other things) ? 3. Wouldn't it be easier to DOS your host with excess traffic (like all modern DDOS attacks), rather than find a remote-code-execution buffer overflow 0day and use it solely to starve resources on a bastion host? 4. Why don't you use a VPN? If you used a udp-based VPN nobody would even know the port was open (connectionless) and you could even require a preshared key, which is the more secure equivalent of port knocking.
- arde 12y ago
  Regarding item 4, a VPN solution is considerably more complex and error prone than port knocking plus SSH. What do you do if/when your VPN service fails? I think you would usually have a VPN service AND a port knocked SSH backdoor.
  - peterwwillis 12y ago
    Yes, good security is usually more complex, though error prone I don't think is accurate. What do you do when your SSH or port knocking service fails?