knockknock

It also works only with iptables. And because it's from 2012, it's watching the file /var/log/kern.log [0], which was a simple way to monitor for incoming packets in 2012, but will not work anymore with systemd based distributions nowadays, since all logs are binary and thus accessible through an util such as journalctl. Someone opened a PR to address this [1]. It tries to keep it simple in the spirit of the tool, but it adds another dependency (a systemd python module). I like it overall. The code is so small and simple, it's easy to adapt and to keep small anyway, whatever distro and firewall one might end up use it with. [0] https://github.com/moxie0/knockknock/blob/bf14bbffc5f1d2105c... [1] https://github.com/moxie0/knockknock/pull/7

I wonder if Moxie would now consider knockknock "cryptographically doomed"? From the README, whose commit [1] is dated 2011-09-15: > The request is encrypted using AES in CTR mode, with an HMAC-SHA1 using the authenticate-then-encrypt paradigm. A mere three months later, he would publish The Cryptographic Doom Principle [2] (dated 2011-12-13). [1]: https://github.com/moxie0/knockknock/commit/e24eb33f666fc092... [2]: https://moxie.org/2011/12/13/the-cryptographic-doom-principl...

Pretty cool. Have you seen considerations regarding port knocking by Moxie Marlinspike? I think he raises some valid points: https://github.com/moxie0/knockknock Instead of using UDP he reads the firewall log. Also he prevents replay attacks (even though his implementation is apparently not secure in this regard). Unfortunately his code is ancient and in Python 2, so a rust implementation would be awesome.

Port knocking is one of those things that sound like a good idea, but there are many possible footguns. And why is it that there is no one consensus (or "blessed") implementation? The implementation by Moxie seems interesting, but needless to say that Python 2 is an instant no-go: https://github.com/moxie0/knockknock It hasn't been updated in 12 years, so why is it that there seems almost no real interest in a solid port knocking implementation?

I much prefer the approach I read about in https://github.com/moxie0/knockknock (use a safe language, trust basically only the program you write and the language), to a random port daemon written in C which pulls libpcap to sniff everything. To some extent knockknock also trusts the Python interpreter which is not ideal (but maybe OK)

It's old and there are probably friendlier options out there now, but https://github.com/moxie0/knockknock/blob/master/INSTALL

Some versions of port knocking require a specific type of packet. https://github.com/moxie0/knockknock

Correct me if I'm wrong, but I don't think iptables allows you to authenticate the knocks? Also, anyone listening to your network would be able to replay the sequence and open the port. This project reminds me a bit of moxie's knockknock[1], where the idea of port knocking is kept intact, but with some added security. Plus, it seems really easy to setup, compared to writing dozens of iptables rules. [1]: https://github.com/moxie0/knockknock

Thanks! The only tool I can think of right now is moxie0's tool https://github.com/moxie0/knockknock back in 2011. About the TCP port, if it's already open, you'll just have to wait for the next HMAC because of the very limited communication. Finally, the choice of md5 was made because of the 16 Bytes output (knockles uses 10 of them), but don't hesitate to make a pull request!

> Or is completely firewalled off from the world, and only accessible once you've authenticated yourself to your VPN. Or only reachable once you first authenticate (public/private keys, two factor crypto key auth, etc) to a bastion host, and then reach the system from the bastion. There's a lot of attack surface in there. Port-knocking is supposed to be a way to reduce attack surface. It's a belt-and-suspenders approach to the reality that even fully patched openssh has exploitable bugs. Using this tool, a MITM with an openssh 0day can just follow you in. KnockKnock [0] and tools like it do not suffer from this defect. This tool is conceptually similar to KnockKnock, using OTP instead of a monotonic counter. Using OTP opens it up to replay attacks. https://github.com/moxie0/knockknock

A few useful resources: If you don't want your SSH server being found by trivial port-scanning, apply port-knocking: https://github.com/moxie0/knockknock If you want to help secure the interwebs, host this tarpit to try to slow down network scanners: https://github.com/skeeto/endlessh

I think this implementation avoids that problem. https://github.com/moxie0/knockknock

Thanks, seems this is the (also outdated) repo: https://github.com/moxie0/knockknock Yes I suppose one of the forks is better nowadays