fwknop

Yes something like that has been done, the solution uses asymmetric cryptography instead of symmetric and it protects the entire communication stream instead of just opening the gates - it's called Wireguard. I jest, but you're describing authentication protocol which uses the UDP destination port field to carry each character of the "one time password" in a roundabout way. You could simply send 1 packet containing the password to the daemon. I've never seen it used in the wild but apparently, it exists: https://github.com/mrash/fwknop

fwknop's default is to run as root, so there's that. Support for separation of privileges is still pending since 2013 (https://github.com/mrash/fwknop/issues/32)

Port knocking is so 2014. Single Packet auth for publicly exposed hidden services is great: https://github.com/mrash/fwknop

How does this distinguish itself from fwknop? https://github.com/mrash/fwknop And what have you got to protest against DoS attacks on your packet inspection mechanism?

I've not used it, but this ssh wrapper was mentioned here a few days ago: https://github.com/mrash/fwknop

SSH and other services can be further protected by Single Packet Authentication (SPA), https://github.com/mrash/fwknop > SPA requires only a single packet which is encrypted, non-replayable, and authenticated via an HMAC in order to communicate desired access to a service that is hidden behind a firewall in a default-drop filtering stance. The main application of SPA is to use a firewall to drop all attempts to connect to services such as SSH in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) more difficult.

> Is this approach used elsewhere? Yes, or at least in a similar fashion. An alternative variant of port knocking is SPA (Single Packet Authorization). Often SPA protocols use UDP and contain within the body field an encrypted payload containing all the required data to authenticate and authorize a particular request. There are multiple different implementations of SPA: OpenSPA [1] (full disclosure: I am the author of OpenSPA), fwknop [2] just to name a few. SDP (Software Defined Perimeter) often builds upon SPA technologies in order to achieve a form of zero trust access. [1] - https://github.com/greenstatic/openspa [2] - https://github.com/mrash/fwknop I am currently re-writting the OpenSPA protocol (version 2) and I plan on playing around with eBPF as well, so thanks eeriedusk for paving the way :)

> Anyway, interesting approach using a secret like this. Is this approach used elsewhere? yes, fwknop https://github.com/mrash/fwknop

Port scanning can be trivially distributed over multiple IP addresses and rate limited. So blocking one IP address won't do much to block a port scan coming from another IP address. When I tried to apply somewhat similar solutions in the past (e.g. fail2ban), I ended losing access to the server a few times (misconfiguration/bugs/daemon killed/firewall rule conflicts/etc.). A more secure way to prevent port scanning is Single Packet Authorization, e.g. fwknop [1] "SPA requires only a single packet which is encrypted, non-replayable, and authenticated via an HMAC in order to communicate desired access to a service that is hidden behind a firewall in a default-drop filtering stance" Port scans happen all the time, and your security shouldn't rely on hiding that information. Port scans are a mild annoyance, as they litter the logs. I changed

eavesdropping, maybe. There are tools like https://github.com/mrash/fwknop that are not vulnerable to that or brute-forcing. But brute forcing in general? not a chance. There are 18446744073709551616 4 port sequences.

Personally I avoid knockd and instead use something like fwknop https://github.com/mrash/fwknop. You get the advantage of port kocking while protecting yourself from re-play attacks. The main dis-advantage is it is a more complicated procedure so it may limit you a bit. How I set it up specifically: https://peekread.info/tech/20190513-fwknop/

Fwknop is a much better solution than whack-a-mole blacklisting or even Fail2Ban. https://github.com/mrash/fwknop