News for hackers. Stuff that matters.

A comment on Port knocking. Parent comment

Re:Port knocking by rsync on Thursday May 14, 2020 @10:20PM (#23188158)
My default ipfw ruleset is very restrictive - no ports open.

The command that gets run when the (correct) knock comes in is an ipfw command:

  /sbin/ipfw add 01021 allow tcp from %IP% to 10.0.0.10 22,443 setup
... so now the knocking IP can see TCP 22 and 443 (and nothing else).

I then have a cron job that runs every night at midnight that deletes those rules:

  0 0 * * * /sbin/ipfw delete 01021
... so I am required to knock daily.

The following is a little lame, but I want to see who has knocked so far today (should just be me and my own IPs) so I do this every minute:

  * * * * * /sbin/ipfw show|/usr/bin/grep ^01021 | awk '{print $7}' > /tmp/.knock_list
... and then cat that list to myself every time I log in ...
[ Parent | on HN ]
Re:Port knocking by polishdude20 on Thursday May 14, 2020 @10:51PM (#23188328)
So with poet knocking, if I only have an ssh port open and a couple of ports my servers server content on like an http and https server, I'm assuming id use port knocking to get inside my ssh port right? I don't need to do port knocking for my http and https ports because they're open but not as an ssh service?
[ Parent | on HN ]
Re:Port knocking by rsync on Thursday May 14, 2020 @11:09PM (#23188447)
Yes, that's right - you'd leave your public services open by default and the knock would simply open up tcp22 ...
[ Parent | on HN ]
Re:Port knocking by TedDoesntTalk on Thursday May 14, 2020 @10:57PM (#23188370)
> So with poet knocking

Knocking a poet is bound to get you into trouble. Poets fight back, and hard. Just don't do it.

[ Parent | on HN ]
Re:Port knocking by polishdude20 on Friday May 15, 2020 @11:05AM (#23192997)
But they're just so damn eloquent all the time. It drives me nuts.
[ Parent | on HN ]