The only tool I can think of right now is moxie0's tool https://github.com/moxie0/knockknock back in 2011.
About the TCP port, if it's already open, you'll just have to wait for the next HMAC because of the very limited communication.
Finally, the choice of md5 was made because of the 16 Bytes output (knockles uses 10 of them), but don't hesitate to make a pull request!
Given that there's really no major performance/security benefit it's totally fine to use md5 imo, I shouldn't have even mentioned it in retrospect lol I just see "md5" and immediately my brain is like "hmmm".
Collision chance is still pretty low, my guess is that in practice unless you're doing something automated that performs hundreds of SSH's a day you won't run into it (30 seconds of "collision time" every 2-4 hours, based on my math).
Anyway, yeah, super into this.
Yes, or at least in a similar fashion. An alternative variant of port knocking is SPA (Single Packet Authorization). Often SPA protocols use UDP and contain within the body field an encrypted payload containing all the required data to authenticate and authorize a particular request.
There are multiple different implementations of SPA: OpenSPA [1] (full disclosure: I am the author of OpenSPA), fwknop [2] just to name a few.
SDP (Software Defined Perimeter) often builds upon SPA technologies in order to achieve a form of zero trust access.
[1] - https://github.com/greenstatic/openspa
[2] - https://github.com/mrash/fwknop
I am currently re-writting the OpenSPA protocol (version 2) and I plan on playing around with eBPF as well, so thanks eeriedusk for paving the way :)
yes, fwknop https://github.com/mrash/fwknop
Anyway, interesting approach using a secret like this. Is this approach used elsewhere?
Based on this it looks like the service will change what port it's listening on every N seconds. What happens if a port on the server is already open/ reserved though?
Also, not that it really matters from a security perspective, but md5 seems like a bit of an odd choice. There are faster options available. Might be nice to allow it to be configured.
Cool stuff.