TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Why Not Use Port Knocking? (2012)

36 点作者 srisa超过 11 年前

13 条评论

zippergz超过 11 年前
I don&#x27;t use port knocking, and I&#x27;m not convinced anyone should. But something bugs me about this kind of discussion.<p>There are two broad classes of attackers: targeted attackers, who specifically want to get into your system, and script kiddies who are scanning broad swaths of the Internet looking for an easy target. Most of these countermeasures, like port knocking and moving sshd to a different port, do very little to dissuade the first group. But they make you much less of a target for the second group.<p>These discussions (and so many security discussions on the internet) make the argument that unless something is effective against targeted attackers, it&#x27;s not worth doing. That&#x27;s ridiculous. In the 20+ years I&#x27;ve been running computers on the internet, targeted attackers are outnumbered by random scans thousands to one. Of course, you&#x27;ll say, any countermeasure that&#x27;s good enough to stop targeted attackers is good enough to stop these guys as well. And that&#x27;s true, but for two things:<p>1. I like my logging and alerting to intentionally be loud when a targeted attacker is messing with my system. By raising the bar enough so that <i>only</i> targeted attackers get through, I&#x27;m able to do that.<p>2. There have been zero-day vulnerabilities in probably most of the daemons I&#x27;ve run over the years. And when those zero-days come, I inevitably get hit with <i>random</i> scans looking for vulnerable versions. Those are almost always stopped cold by things as simple as running on a different port. I&#x27;d like to think I&#x27;m pretty good at keeping up with vulnerability alerts and updating my software when something like that happens, but simple changes that buy me a little time aren&#x27;t a bad thing.
评论 #6482690 未加载
tptacek超过 11 年前
Obligatory: I think port knocking is really silly and you shouldn&#x27;t waste time with it. Disable root logins and password logins in SSH. If you have lots of hosts running SSH, collapse them down to one exposed SSH bastion host. Then get on with your life.
评论 #6482314 未加载
评论 #6482674 未加载
评论 #6482311 未加载
评论 #6485062 未加载
评论 #6482819 未加载
评论 #6483059 未加载
Sami_Lehtinen超过 11 年前
I personally see port knocking with cryptographic payload just as one tool on layered security. I&#x27;m still wondering why people bother horrible VPN&#x2F;IPsec junk with annoying clients. I got something like 10 different clients installed. It shouldn&#x27;t be required at all, if systems and protocols are already secure. You can use something like TOTP key as payload to open ports up or something more complex&#x2F;secure if you want.<p>Afaik passwords aren&#x27;t bad option either. You should consider password as shared secret blob, not as password. It&#x27;s as unlikely that someone is going to guess 256 bit password as it is that they guess any other 256 bit secret.
arethuza超过 11 年前
Completely off topic - I find the term &quot;Port Knocking&quot; somewhat amusing as my home village is Portknockie<p><a href="http://www.portknockiewebsite.co.uk/" rel="nofollow">http:&#x2F;&#x2F;www.portknockiewebsite.co.uk&#x2F;</a><p>[NB I say home as my family has been there pretty much forever, I live in Edinburgh]
评论 #6482709 未加载
teddyh超过 11 年前
&gt; Title: Why Not Use Port Knocking?<p>For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, <i>increase your password lengths</i>. If you want to keep log sizes manageable, <i>adjust your logging levels</i>.<p>1) <a href="https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Kerckhoffs%27s_principle</a>
评论 #6482225 未加载
评论 #6482497 未加载
评论 #6482762 未加载
评论 #6482248 未加载
Zenst超过 11 年前
I&#x27;ve used it before, though this article seems to be fixated upon a fixed port sequence and fairly compares that to a password layer that is futile as between you and the server your knocking many people can see and know that sequence, making it moot.<p>Which I agree with. But if you use a port sewquence derived from a S&#x2F;KEY, then each port knock sequence is a one time sequence never to be repeated.<p>It is a simple and dirty level of security using the much hated obscurity approach, but by varying the ports via a aranged S&#x2F;KEY sequence you can move it up a whole level. S&#x2F;KEY easy to do and worked well on old old old nokia over 10 years ago as a little simple java app. Just using it to derive a port sequence instead of a one time password.
lazyant超过 11 年前
I don&#x27;t use port knocking but:<p>&quot;all implementations had the downside of adding yet another piece of clearly experimental software to my system along with somewhat convoluted procedures for setting the thing up&quot; what? you can add port knocking with literally 3 iptables rules, netfilter is a rock-solid proven piece of software.<p>&quot;explain to me what problem this is supposed to solve.&quot; visibility: if target cannot be found there&#x27;s no target to attack; security by obscurity is good (as long as security doesn&#x27;t depend just on it).<p>I use bastion host to ssh to my servers with key and different port (yes different port is good; for a couple of sysadmins who cares we broke some standard?)
评论 #6482564 未加载
cperciva超过 11 年前
I don&#x27;t use port knocking because spiped is simpler and far more secure.
评论 #6482988 未加载
srisa超过 11 年前
<i>Each value is a 16-bit number, with a size of two bytes, or equal to two ASCII characters or one Unicode character. Port knocking examples generally do not run to more than three packets, which means that the minimum amount of information a prospective attacker would need to get right in order to gain access is six bytes, equal to six ASCII characters or three Unicode characters.</i><p>Is the brute force effort being simplified too much? Wikipedia entry says this about brute force attack on port-knocking: <i>As a stateful system, the port would not open until after the correct three-digit sequence had been received in order, without other packets in between.<p>That equates to a maximum of 655363 packets in order to obtain and detect a single successful opening, in the worst case scenario. That&#x27;s 281,474,976,710,656 or over 281 trillion packets. On average, an attempt would take approximately 9.2 quintillion packets to successfully open a single, simple three-port TCP-only knock by brute force.</i>
评论 #6482973 未加载
oakwhiz超过 11 年前
I wonder if some port knocking schemes can be attacked using a De Bruijn sequence. If the firewall only examines the last N potential knocks amongst K ports, sent from a given IP address, then every possible combination of knocks can be bruteforced in just K^N knocks (by taking into account the existence of every permutation as a subsequence within the De Bruijn sequence) instead of the more obvious (K^N)*N knock solution (naively trying each permutation in sequence.)<p><a href="https://en.wikipedia.org/wiki/De_Bruijn_sequence" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;De_Bruijn_sequence</a>
gmuslera超过 11 年前
fwknop ( <a href="http://www.cipherdyne.com/fwknop/" rel="nofollow">http:&#x2F;&#x2F;www.cipherdyne.com&#x2F;fwknop&#x2F;</a> ) uses a single connection try (with certificates and that cannot be replayed even if captured) to open a port. It adds another potential point of failure in your chain to access, but if is simple and well tested enough could work as a protection.<p>And the main reason to have port knocking (over, i.e. fail2ban) is not stopping brute force attacks, but future vulnerabilties and exploits in services that should not be used by the whole internet. If there are very few persons, or machines that should connect to a service (and the origin IPs are not fully known to enable just them in the firewall) putting a fwknop or similar layer over that services should avoid external people to even try to connect to those services.<p>And there actually had been vulnerabilities in ssh, vpns, puppet (a remote code execution vulnerability for it has been patched this very week) and more that could had been exploited before you knew about them.<p>Also, &quot;plain&quot; port knocking could be protected against brute force scanning by having trap ports, if you hit them, then your IP is blocked. That won&#x27;t protect from MITM that see how you connect (NSA at the very least), but will prevent scanning.
utnick超过 11 年前
I see port knocking as protection against an 0day sshd exploit instead of protection against brute forcing.<p>The article didn&#x27;t really mention that angle.
antocv超过 11 年前
That was a lot of words to encourage use of authors own tool instead of or aside perhaps even with port knocking.<p>The article hasnt anyway delivered any meaningful reason not to use port knocking, just a few straw-man arguments such as &quot;most people only setup 3 port sequences&quot;.<p>The idea presented though is an interesting one, run your ssh on one port, and when that one authenticates with any method, only then allow connections to a second ssh on another port, which has perhaps only then begun listening or being allowed to accept connections from that specific uid, and if that authenticates then the user is in. Like having two gates infront of a city instead of a secret handshake with 16 port sequences say.