Knockknock: Simple, secure, and stealthy port knocking implementation

Re:Knockknock: Simple, secure, and stealthy port knocking im... by rsync on Wednesday August 28, 2024 @01:37PM (#41381990)

Port knocking is a simple and effective addition to a defense-in-depth strategy.

Whatever layers of defense you already have in front of your ssh server, port knocking makes it (very slightly) safer.

If knock/knockd were fragile or complex then you’d need to carefully weigh that benefit against increased fragility.

But it’s not. You get the benefit at no real cost.

(I speak of the knock binary in FreeBSD ports - I have no experience with this weird python one …)

[ Parent | on HN ]

Re:Knockknock: Simple, secure, and stealthy port knocking im... by thomashabets2 on Thursday August 29, 2024 @06:17AM (#41389200)

Ok, I should have been more clear.

Modulating SYN packets is stupid.

Port knocking by sending a secret to the server, in a very simple protocol (to the point of being obviously correct), is good. Once it gets too complex, the implementation is more likely to have a bug than OpenSSH.

So just send that secret in a UDP packet. Modulating SYN packets is like sending your password (or other secret) in morse code rather than ASCII, for no reason.

I elaborated more in https://news.ycombinator.com/item?id=41389167

[ Parent | on HN ]