News for hackers. Stuff that matters.

A comment on Port knocking.

Re:Port knocking by rubyn00bie on Thursday May 14, 2020 @09:16PM (#23187760)
And to save other folks a search, this is pretty awesome:

https://linux.die.net/man/1/knockd

[ Parent | on HN ]
Re:Port knocking by geoffeg on Thursday May 14, 2020 @09:41PM (#23187907)
If someone intercepts the traffic to my server, they could see the knock sequence and re-use it. Is there any way to get knockd to use a google authenticator-like sequence of port knocks?
[ Parent | on HN ]
Re:Port knocking by thedanbob on Thursday May 14, 2020 @09:48PM (#23187958)
I use fwknop[0] on my servers. It does single-packet authorization rather than straight port knocking, which solves the replay issue.

[0] https://www.cipherdyne.org/fwknop/

[ Parent | on HN ]
Re:Port knocking by cortesoft on Thursday May 14, 2020 @10:55PM (#23188354)
You block a MITM attack with public key cryptography. Port knocking is not meant to stop MITM attacks.
[ Parent | on HN ]
Re:Port knocking by magicconch on Friday May 15, 2020 @11:39AM (#23193425)
Yes, take a look at the manual page for knockd and search for "One_Time_Sequences". It does what you are asking by using a one-time valid sequence of port knocks, but it is like HOTP rather than TOTP.
[ Parent | on HN ]