Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Combining Port Knocking With OS Fingerprinting

timothy posted more than 10 years ago | from the belt-and-suspenders-and-tape-and-elastic dept.

Security 154

michaelrash writes "Port knocking implementations are on the rise. I have just released fwknop; (the Firewall Knock Operator) at DEF CON 12. Fwknop implements both shared and encrypted knock sequences, but with a twist; it combines knock sequences with passive operating system fingerprints derived from p0f. This makes it possible to allow, say, only Linux systems to connect to your SSH daemon. Fwknop is based entirely around iptables log messages and so does not require a separate packet capture library. Also, at the Black Hat Briefings, David Worth has released a cryptographic port knock implementation based around one-time pads."

Sorry! There are no comments related to the filter you selected.

It's kinda cool (5, Interesting)

Lord Kano (13027) | more than 10 years ago | (#9856583)

but is anyone out there using port knocking for serious security?

LK

Re:It's kinda cool (3, Insightful)

Anonymous Coward | more than 10 years ago | (#9856596)

it appears port knocking is a neat programming project and it seems fun to create a poc.

it seems like a fad, and of course the authors of such programs will defend its usefulness.

my opinion is that this technique is not new, and hackers have been using very similiar things for decades.

and since he mentioned defcon, oh boy has that hacking con gone down hill. Bugs are just not as easy to find now days so the bar has been raised for h4x0rs.

Re:It's kinda cool (1, Interesting)

quelrods (521005) | more than 10 years ago | (#9856670)

no. Not only is it security through obscurity, but it slows down connections. ie: you have to go through the handshake sequence to start the connection. It's mostly a substitute for people keeping their patches up to date. Don't expect the NSA to use this anytime soon.

Re:It's kinda cool (5, Insightful)

Lord Kano (13027) | more than 10 years ago | (#9856764)

Not only is it security through obscurity

Only in the same sense that passwords are security through obscurity.

Right combination of keystrokes, right combination of ports to knock, these sound very similar to me.

LK

Re:It's kinda cool (0)

Anonymous Coward | more than 10 years ago | (#9857527)

Sounds similiar to sending your password over a non encrypted channel.
Just like telnet and ftp which are non-secure protocols.
Only way to have even a reasonable sense of security through obscurity is to only use each port knocking sequence once and then disable it and enable the next sequence for that user.
Mind you i still don't trust it. It's unesscary and and an incovenience for users.

Re:It's kinda cool (4, Insightful)

eric76 (679787) | more than 10 years ago | (#9856973)

There is absolutely nothing wrong with using something a bit obscure to help fend off attacks.

The only time that "security through obscurity" is wrong is if that is your entire approach to security.

Even if you have the latest and greatest copy of the most secure software written to perform some service, there is always a possibility that there is something exploitable that is yet unknown.

Port knocking is an excellent way to greatly reduce the probability that someone will be able to use a newly discovered exploit from using it against your server before an update is available to fix the exploit.

Of course, if someone is in the right place and can monitor the network traffic from another computer somewhere along the path, they can discover the port knocking sequence. For that reason, you still need your normal security and you still need to keep the patches up to date.

But the result will still be a vastly improved possibility of avoiding an attack when a vulnerability is found.

Re:It's kinda cool (1)

michaelrash (715609) | more than 10 years ago | (#9857282)

What about the set of hackers (crackers) that have found 0-day attacks? Granted the number of people that fall into this category is extremely small, but the data on my personal system is just too important to risk it. I want an additional layer of security. Although security through obscurity is not good if it is the _only_ protective mechanism, having another layer always helps:

"Security Through Obscurity" Ain't What They Think It Is [bastille-linux.org]

Re:It's kinda cool (1)

TheLittleJetson (669035) | more than 10 years ago | (#9856675)

serious... this is better than password / challange -- WHY? -m

Re:It's kinda cool (5, Insightful)

Sancho (17056) | more than 10 years ago | (#9856814)

It's not.. I almost suspect you of trolling.

The primary purpose of port knocking is to hide the fact that you have open ports to begin with. You don't want to have those ports unprotected once the right knock sequence is in place. You want both password/challenge AND port knocking so no active scanner detects your open ports.

Re:It's kinda cool (3, Informative)

Anonymous Coward | more than 10 years ago | (#9856825)

Port knocking uses a specific authentication scheme, most often based on one-time passwords or other cryptographic means, to open access from a specific address for a very brief period of time.

I am not aware of PK schemes that just open the port wide once you send in a magic passphrase, that would be dumb.

In this regard, PK is quite similar to any other access scheme; the access control is a bit coarse, but so are all protocol-specific NAT helpers in firewalls, and most folks do not complain.

Re:It's kinda cool (4, Interesting)

HermanAB (661181) | more than 10 years ago | (#9856945)

I use portsentry for protection against scans. The result is that all my ISP scanners are now in hosts.deny and consequenlty I can run any server I want and they will never know and can't complain about it...

Re:It's kinda cool (2, Informative)

Tony Hoyle (11698) | more than 10 years ago | (#9857208)

Well, as long as it goes through tcpwrappers anyway....

Most services don't though. You should be updating iptables not hosts.deny.

is is what IT is (-1, Offtopic)

Anonymous Coward | more than 10 years ago | (#9856584)

Whats with the 'nothing to see here move along' article. Oh.. I know, I was so quick I even beat the article to first post.

How much more is needed? (2, Insightful)

Anonymous Coward | more than 10 years ago | (#9856586)

With a large port knock routine say 20 ports or more, can't you be sure it's YOUR box that's comming in? More defense and limitations are good, sure, but why filter by OS? Is it in case someone gets by the knock?

Re:How much more is needed? (-1, Flamebait)

Anonymous Coward | more than 10 years ago | (#9856601)

Because Linux elitists enjoy a chance to exclude windoze any chance they get.

Re:How much more is needed? (5, Interesting)

vranash (594439) | more than 10 years ago | (#9856624)

Because the next step is to generate 'fake' OS fingerprints for the client computer, thus insuring not only must someone reply with the right sequence, but also send back the nuances of a specific OS to do so... kinda like recieving a callback to which you must reply in the proper accent before you'll be allowed in :)

The above is completely conjecture, but it sure does sound cool ;p

-- vranash

Re:How much more is needed? (4, Interesting)

Xepo (69222) | more than 10 years ago | (#9856697)

Well, as another poster pointed out, if someone sniffs what ports you're connecting to, then it would be simple to replay that knock. That's the reason you need a security level underneath it, and shouldn't rely on port knocking unless it's a changing sequence (like the one-time pad idea also mentioned in the post).

I'm not quite sure how the OS detection is supposed to help. Maybe you could customize things for different OSes? As long as port knocking schemes are implemented on two OSes, you could let the port knocker determine which OS you're connecting from, and connect to a specific service depending upon it. I don't really see any other use for the OS-dependent port knocking, but it's something that's cool, and not been done before, so I guess it's news-worthy.

Re:How much more is needed? (0)

Anonymous Coward | more than 10 years ago | (#9856925)

Question:

if someone sniffs what ports you're connecting to, then it would be simple to replay that knock.

Sniffing the traffic includes sniffing the OS fingerprint, right? So replaying the knock could easily include the OS fingerprint, even if forged?

Re:How much more is needed? (2, Insightful)

Xepo (69222) | more than 10 years ago | (#9856955)

Correct. The OS fingerprint isn't really even that hard to fake. Read the nmap man page if you're curious, it explains a bit more about it. It basically just has to do with how quickly, and in what way the ip layer responds to different things. (I've not looked at the link in the article so I dunno if it explains OS fingerprinting at all, or if it just says that the new port knocking implementation implements it)

Re:How much more is needed? (2, Insightful)

michaelrash (715609) | more than 10 years ago | (#9857308)

Yes. It is just another hoop we can make an attacker jump through. If someone sniffs the knock sequence, they can always replay it but it will only be honored if they replayed the sequence correctly (fwknop implements timing delays in knock sequences) _and_ they generate the sequence from the required OS. Of course, using something like Packet Purgatory [synacklabs.net] OS neuances can be spoofed, but at least the bar is just a little higher.

Re:How much more is needed? (2, Funny)

pebs (654334) | more than 10 years ago | (#9857430)

More defense and limitations are good, sure, but why filter by OS?

It's so we can block out all those Linux machines, because we all know that's where the hackers are coming from :)

OS fingerprinting, whew! (4, Funny)

Anonymous Coward | more than 10 years ago | (#9856588)

thank goodness, if there's one thing a hacker can't get his hands on, it's a copy of Linux!

yuk yuk yuk

Layers (4, Interesting)

danielrm26 (567852) | more than 10 years ago | (#9856589)

1. TCPWrappers (has to be be right IP and/or daemon)
2. Portknocking (has to have the right sequence)
3. Passive Fingerprinting (only Linux and BSD systems can connect)
4. Keys Only (you must have the correct DSA private key)

Usually unnecessary, yet very interesting - much like Slashdot itself....

The more complicated you make it, (5, Insightful)

Anonymous Coward | more than 10 years ago | (#9856593)

the bigger is the chance of screwing up. The point of port knocking is to have a simple and therefore less bug prone layer around real authentication systems like ssh, so that when a bug in ssh is found, portscanners don't find your vulnerable service. Complicated port knocking systems defeat the purpose of port knocking.

Re:The more complicated you make it, (0)

Anonymous Coward | more than 10 years ago | (#9856695)

the more difficult it is to break into the system?

sounds about right.

(who cared what the "point" of port knocking "is" according to the people who have thought about it sofar, if new people can come up with ways to implement it _other_ than for reasons which origionally sparked the thought, aint that what being a "geek/nerd" is all about? (finding new and interesting ways to use things that would otherwise be considered yesterdays news, is "where its at".)

Re:The more complicated you make it, (0)

Anonymous Coward | more than 10 years ago | (#9856721)

No, it does not add more security. There already is a cryptographical authentication scheme. Adding another potentially exploitable crypto scheme on top of it reduces security by increasing the risk of bugs. If you want to increase overall keylength, do it in SSH, not by adding another crypto system. You may think that there is more to port knocking because you're fascinated by all the bells and whistles which can be added, but if you analyze the effects of adding these on the whole system, there is only one sane conclusion: Don't do it.

Re:The more complicated you make it, (2, Insightful)

Anonymous Coward | more than 10 years ago | (#9856737)

Good.

Now look at the complexity and functionality of SSH, and its share of security problems over the past years.

Then look at port knockers, their simplicity and minimal reliance on bloated libraries. Note they only use a single, simplistic - but cryptographically proven - authentication scheme based on things such as basic symmetric ciphers or one-way shortcut functions, with implementations that could hardly go wrong.

The whole point is, SSH and many other complex services have proven to be not reliable and secure enough to be left open wide without losing sleep over it. Protecting them with a simple and secure solution consisting only of dozens or hundreds lines of code makes sense.

So how long.... (0, Interesting)

Anonymous Coward | more than 10 years ago | (#9856600)

Until someone makes us a Nice Gnutella or other P2P sharing app that can use this + PGP encryption so we can set up our closed networks and avoid the Corperate Nazi???

People are gonna share, get over it.

Re:So how long.... (2, Interesting)

HermanAB (661181) | more than 10 years ago | (#9856956)

Install portsentry. Wait until corporate Nazi scanned your machine and got added to hosts.deny. Enjoy the freedom.

Re:So how long.... (0)

Anonymous Coward | more than 10 years ago | (#9857247)

Wait until Anonymous Coward scans your machine with fuckportsentry.pl and everyone in the world gets added to hosts.deny.

Enjoy the "freedom" :-)

In other news... (4, Funny)

AvantLegion (595806) | more than 10 years ago | (#9856603)

Microsoft IIS has implemented a similar scheme to only allow HTTP sessions to Microsoft OS running clients.

Re:In other news... (1)

Nicholas Evans (731773) | more than 10 years ago | (#9856768)

Breaking news (Day One): Prominent eBusinesses lose millions over IIS update!

Breaking news (Week later): IIS loses 30% market share due to stupid move on the part of the developers!

MS may be monopolisitc, but they aren't exactly stupid.

Re:In other news... (1)

v1x (528604) | more than 10 years ago | (#9856784)

forgive my very little knowledge on the subject, but wont it be possible to sniff for & duplicate the port-knocking behavior of windows using any other OS?

Re:In other news... (2, Funny)

Curtman (556920) | more than 10 years ago | (#9856914)

I was thinking more along the lines of banning any SCO products. In the tradition of appending 'e' to the front of everything, I call it 'eSnobbing'.

Port knocking and some added ingredients (5, Interesting)

ThufirHawat (524457) | more than 10 years ago | (#9856607)

While port knocking is by now an established technique, I do not think OS fingerprinting adds anything useful, because the ease of static replay attacks is left unchanged by OS fingerprinting.
Though not that easy, OS spoofing is not remarkably labour intensive, and setting up a "OS generator" who will replay the static attack with every known OS is a distinct possibility.
In other words, though a nice intellectual possibility, it is perhaps of rather limited application.
Now, mixing instead knocking and a cryptographic application seems to me instead more promising.

Re:Port knocking and some added ingredients (1)

danielrm26 (567852) | more than 10 years ago | (#9856614)

"Now, mixing instead knocking and a cryptographic application seems to me instead more promising."

Yeah, that's what the other guy mentioned did. He's got a one-time-pad implementation that looks pretty cool.

Re:Port knocking and some added ingredients (1)

cynic10508 (785816) | more than 10 years ago | (#9856780)

While port knocking is by now an established technique, I do not think OS fingerprinting adds anything useful, because the ease of static replay attacks is left unchanged by OS fingerprinting.

The problem I see with OS fingerprinting is the assumption that certains OSes are running certain (vulnerable/potentionally trojaned) applications. I don't think you can safely make those assumptions.

Re:Port knocking and some added ingredients (2, Informative)

gabba_gabba_hey (309551) | more than 10 years ago | (#9856861)

The problem I see with OS fingerprinting is the assumption that certains OSes are running certain (vulnerable/potentionally trojaned) applications. I don't think you can safely make those assumptions.

While the method you mention is one way of fingerprinting, most modern tools use a more sophisticated approach. Here [insecure.org] is a fairly simple explanation of some of those methods if you're interested.

Port knocking, firewalls, DMZs,... (4, Insightful)

Rosco P. Coltrane (209368) | more than 10 years ago | (#9856612)

are techniques I've seen appearing for the last 10 years that are designed to compartment sections of the net. They make me sad, because that's definitely not what the net was intended to be, i.e. a global interconected network of machines to freely communicate. Instead, the net is slowly being segregated, and you'll soon have to show some sort of proof of identity to do anything other than HTTP. If you don't believe me, just consider how hard it is to do something as mundane as a DCC CHAT on IRC today, as opposed to, say, in 1994.

I realize the need for these things, basically forced upon us by the combination of commercial interests, shitty insecure OS, script kiddies and greedy crackers (not hackers), but all the same, I can't help realize that the internet of today is a far cry from what it was intended to be in terms of freedom of communication...

Re:Port knocking, firewalls, DMZs,... (4, Interesting)

danielrm26 (567852) | more than 10 years ago | (#9856635)

I agree with your points, but surely you must see that this commentary of yours applies to pretty much every invention known to man that is both powerful and started out being free and open.

Look at air travel - there you have spend a ton of time just getting on a plane because of very few bad people. The Wright brothers didn't want this, I'm sure, but it doesn't mean the invention is being perverted in any way; it only says that our world is hostile and that we must protect ourselves from ourselves. Anything useful and completely open these days is ripe for exploitation.

Re:Port knocking, firewalls, DMZs,... (0)

Anonymous Coward | more than 10 years ago | (#9856641)

Yes I know that, it doesn't mean it's not a bummer. I wasn't advocating anything, just making a remark.

Re:Port knocking, firewalls, DMZs,... (0)

Anonymous Coward | more than 10 years ago | (#9856989)

Look at air travel - there you have spend a ton of time just getting on a plane because of very few bad people.

The delays are not because of the terrorists since it is generally agreed that they won't use that method twice and if they tried the people on board wouldn't allow it.

In England those bad people were called "the King" (in the US they are now called "the current administration") and that is why the founding fathers specifically put into the documents they used to form a new government that people should remain unencumbered when travelling from place to place -

Why? Because they still remembered (as embodied in the Magna Carta) when the King tried to prevent people from moving around after the plagues (they were moving to find better pay for their work and the owning class wanted them to stay in the same place and work for the same pre-plague wages when there was an overabundance of laborers - after the plagues there was a severe shortage of laborers and they wanted to follow the best wages. Since the work was geographically fixed the owning class realized that unfixed wages during a labor shortage could create a bidding war since laborers would move to an area of higher wages and it would create a labor vaccuum in the area they left and they would have to raise wages even higher to get the laborers back.

Our real and virtual ability to move about unemcumbered, unharassed, without checkpoints requiring showing of papers and threat of incarceration is impinged now for the same reasons it was 1500 years ago [american.edu] . Money, power and control.

Re:Port knocking, firewalls, DMZs,... (4, Insightful)

grasshoppa (657393) | more than 10 years ago | (#9856637)

Never under-estimate the power of stupid people in large groups.

I can't help realize that the internet of today is a far cry from what it was intended to be in terms of freedom of communication

Um...wasn't the internet born at the department of defense? Awfully nice of them, to make this huge network for freedom of communication.

Oh, wait, that's not what it was intended for. It was intended to be a network of communication, built to survive outages of several large nodes, in case of a nuclear attack. It's only been as more and more people began romaticising it, that we've come up with this free communications thing.

While I'm not apposed to it, I am realistic about it. Would you leave your car, complete with keys, parked in a stadium parking lot, with an open door, and a sign stuck on the steering wheel saying, "Please don't take"? That's essentially what you do with your computer when you go online without any sort of protection ( short of the sign, mind you ).

Re:Port knocking, firewalls, DMZs,... (0, Funny)

Anonymous Coward | more than 10 years ago | (#9856656)

It's only been as more and more people began romaticising it, that we've come up with this free communications thing.

Dude, you got your history wrong. The DoD thing was the ARPANET. Then came the Internet, that was an extension to universities and scholars. Then came the Innurnet (also called the Intarweb) that was an extension to the rest of us, and as more and more big greedy companies and individuals lay their grubby hands on it, it's turning into something that you could call the CorpyWeb...

It's the Innurnet I was talking about. The Innurnet was free man.

Re:Port knocking, firewalls, DMZs,... (1)

grasshoppa (657393) | more than 10 years ago | (#9856676)

and as more and more big greedy companies and individuals lay their grubby hands on it, it's turning into something that you could call the CorpyWeb...

In what way? What, specifically, is "corporate" about the internet. What has been added to it in say, oh, the past five years, that would make you think that?

Re:Port knocking, firewalls, DMZs,... (1)

Ollierose (202763) | more than 10 years ago | (#9857253)

I think he means the bit where you can now go to www.cocacola.com as well as all those university/govt sites.

Thhe web has become a lot more corporate, in the same way television has (due to advertising). I'm fairly sure that initially, TV was just the programmes and nothing else, although I'm too young to be a primary source ;)

Re:Port knocking, firewalls, DMZs,... (1)

eric76 (679787) | more than 10 years ago | (#9856990)

The first four sites on Arpanet were UCLA, Stanford, UCSB (University of California Santa Barbara), and University of Utah.

Re:Port knocking, firewalls, DMZs,... (2, Insightful)

Sancho (17056) | more than 10 years ago | (#9856664)

What if the choices are between not running a server and running a portknocking server?

I have a private server I use for e-mail, irc, and as a convenient, central location to store files. I have no interest in making this server public--it's only on the Internet because to set up a dedicated line to it would be prohibitively expensive. I don't even want people to know the server is there, and if they do find out it's there, I want security to be as tight as possible. Port knocking, in a way, helps to meet my goals. If I was required to let anyone onto my server, I would take it down, which would be the loss of a private asset.

But that doesn't mean you're not right, in a way. The problem with the world today is that it runs on money. Very little is free. Even some HTTP is pay-per, and that's just the way it is until someone finds a way to pay the bills without milking the customer.

Re:Port knocking, firewalls, DMZs,... (4, Insightful)

enigma48 (143560) | more than 10 years ago | (#9856669)

I'm not a history buff but I can't recall anything I've read about ARPAnet being created with the intention of complete access to all connected machines.

I think the majority of people - geeks included, but not to the exclusion of everyone else - think the internet, on the whole, is performing fairly reasonably. Just like in reality, when you have a small group of people working together, issues of trust are much easier to deal with compared to working with hundreds of millions of people.

Blaming "commercial interests, shitty insecure OS, ..." are symptoms of having a ton of people connected. Assuming the internet would be perfect if those bad people didn't exist, there'd be a new group people didn't like: spammers, NET SENDers, etc. Once they are gone, we'd be left with people that use software we don't like, or people from a country we don't like.

Soon enough, the Internet would be compartmentalized exactly the way you fear - into groups of like-minded people instead.

The Internet isn't supposed to be utopia. It was about making resources easier to access and it does that job amazingly well, given the imperfect people using it.

Re:Port knocking, firewalls, DMZs,... (1)

zangdesign (462534) | more than 10 years ago | (#9856674)

I can't help realize that the internet of today is a far cry from what it was intended to be in terms of freedom of communication...

As the internet becomes more and more available to people, we begin to realize what complete a-holes people can be, thus the need for more and more security measures.

Re:Port knocking, firewalls, DMZs,... (0)

Anonymous Coward | more than 10 years ago | (#9856793)

I think most average users would agree the internet is not secure enough.
Unfortunately for you it sounds, security is the opposite of freedom? What, do you want to be able to browse anyone's computer?
It really sounds more like a rationalization to hack.

Re:Port knocking, firewalls, DMZs,... (0)

Anonymous Coward | more than 10 years ago | (#9856921)

http is fine with me, but I think you're being optimistic.

Green slashdot (-1, Offtopic)

Anonymous Coward | more than 10 years ago | (#9856619)

Color harmony [slashdot.org]

Re:Green slashdot (-1, Offtopic)

Anonymous Coward | more than 10 years ago | (#9856631)

Oh come on now, don't you just love hard-to-read, jizz-colored-on-white fonts? Makes you *deserve* reading Slashdot, instead of just lazily browsing...

Security Through Obscurity (4, Insightful)

gst (76126) | more than 10 years ago | (#9856627)

Not more - not less. All that portknocking does is shifting the security to a layer where it doesn't belong.

And even if you don't want others to see that there are services running on your host there are better solutions. e.g. sending a special string to some UDP port.

If someone can sniff your traffic and he knows about portknocking it's trivial for him to detect it. If someone can't sniff your traffic there's no advantage in using portknocking.

Re:Security Through Obscurity (5, Insightful)

RC515 (801823) | more than 10 years ago | (#9856649)

Port knocking has one specific and reasonable purpose: It hides open ports from port scanners. Yes, it's security by obscurity, but as it's supposed to be another layer, it can increase security if, and only if it's simple enough that there is a near-zero chance of introducing new exploitable bugs into the system. Passive monitoring is not necessarily unexploitable. There are bugs in packet capture tools. There will be exploitable bugs in complicated port knocking daemons. Keep port knocking simple and it can be a valuable security enhancement. Make it complicated and it becomes another thing that can break.

Port knocking buys you the time between a new ssh exploit and the fix. It significantly reduces the chance of being found by portscanners and therefore of being hacked. You still have to fix ssh though.

Re:Security Through Obscurity (2, Insightful)

Xepo (69222) | more than 10 years ago | (#9856689)

The specific example the parent to your comment cited was sending a string to a UDP port. I believe he understands the advantages of port knocking, which you explained unnecessarily. UDP is connectionless, and as far as I can tell, there's not much difference between sending a standard string to UDP to tell the OS to open up the port to you, and port knocking for the same purpose. However, the differences in implementation are vast. UDP is already implemented, whereas these port knocking solutions are still in development. UDP is probably going to be a lot easier to implement without interfacing with the system firewall, hence a lot simpler, and not introducing bugs into your firewall system. About the only advantage port knocking might have over a UDP string is exactly that -- It lays on top of your firewall instead of underneath it, but I'm not quite sure that that would have any advantages whatsoever.

Re:Security Through Obscurity (4, Interesting)

OzRoy (602691) | more than 10 years ago | (#9856728)

People who make blanket statements like "Security through obscurity is bad" really annoy me. What a load of crap.

Secuirty through obscurity is bad when it's the only form of security. However, what is bad about using it to enhance existing security? What is bad about making things that little bit more difficult for a hacker?

No where in this has the author said you should replace your existing security models with this. All it's done is add another layer to help disguise your existing security making it that much harder to crack. No one has "shifted" the security anywhere.

Re:Security Through Obscurity (1, Insightful)

Anonymous Coward | more than 10 years ago | (#9856832)

Huh ? Did you read the article ? Hiding your pincode for your credit card is security through obscurity, not more - not less. See how stupid this is ?

Security through obscurity is valid in some case, when the obscurity is deep enough that guessing in the dark is time expensive and must be repeated for each intrusion, and simple enough for the user. For example a security based on hiding logic only needs 1 successfull attempt to be broken (guess the logic and the security is broken until changed, which is not simple), and using a weak password is not time expensive to crack, so both are not valid use of StO.
In the case of port knocking, since it's based on a port sequence, it's analogue to a password, which means that it depends on the user choice of a good sequence (i.e. not trivial).

If you're concerned about the safety of the communication channel, The same problem arises also with traditionnal passwords. Then using One Time Pads (as suggested by the article) solves this problem.

Re:Security Through Obscurity (1)

Baal Sebub (797455) | more than 10 years ago | (#9857006)

And even if you don't want others to see that there are services running on your host there are better solutions. e.g. sending a special string to some UDP port.

Sounds interesting. Is there an implementation of this scheme already available?

Re:Security Through Obscurity (4, Interesting)

wolfb (613683) | more than 10 years ago | (#9857103)

I agree that UDP could be used similarly to port knocking. Both methods will serve equally well when the attacker is unaware of the method you choose to use. (true security through obsecurity). I also agree that both methods are equally vulnerable if the attacker can sniff your network traffic, and they can get in by replaying the requests.

However, lets assume that the security daemons are *not* vulnerable to replay type attacks becuase we use one time pads, or computed keys or something. In this case, sniffing will tell the attacker what method is in use, but it won't allow them to get in by simply repeating a successful login sequence. Are the methods still equivalent?

I would think that port knocking would still be safer of the two. The port knocking monitor is still sitting behind the firewall, isolated from the network traffic. It would be more difficult to induce a failure in the monitor. Even if the monitor failed, the security would revert to the firewall -- which means you don't get in.

On the other hand, your UDP daemon would have to be written just as carefully as the services you are trying to protect. A buffer overflow, or any similar flaws in your daemon could allow someone to break in through your daemon. And such a flaw could be exploited blindly too -- all the attacker would have to suspect is that you are using a flawed daemon.

Am I wrong?

Re:Security Through Obscurity (4, Interesting)

groomed (202061) | more than 10 years ago | (#9857105)

Not more - not less. All that portknocking does is shifting the security to a layer where it doesn't belong.

Yes, but that's exactly the point. Portknocking is a steganographic application: it doesn't protect the message, but hides the existence of the message. It does so precisely because it interferes at a layer where it doesn't belong.

And even if you don't want others to see that there are services running on your host there are better solutions. e.g. sending a special string to some UDP port.

No, because having a server listen on a UDP port clearly signals the expectation of meaningful communication. The equivalent of portknocking would be a server that listens on a UDP port, but rather than looking at the string it receives, looks at (say) the delay between each byte received. Obviously network delays and other uncontrollable factors make this impractical.

If someone can sniff your traffic and he knows about portknocking it's trivial for him to detect it. If someone can't sniff your traffic there's no advantage in using portknocking.

It's not that simple. Even if somebody can sniff traffic in principle, he can't sniff everybody's traffic all the time. He has to evaluate which targets are likely to yield anything of value. Since a system protected by portknocking does not give him any clues of what he can expect to find, why would he sniff your traffic?

these ports are made for knockin' (2, Funny)

Anonymous Coward | more than 10 years ago | (#9856642)

and that's just what they'll do

one of these days these ports

are gonna walk all over you........

Re:these ports are made for knockin' (0)

Anonymous Coward | more than 10 years ago | (#9857167)

It is funny!, but should it not be ...

are gonna knock all over you...

Wow. (0)

Anonymous Coward | more than 10 years ago | (#9856653)

A whole Slashdot story just to post your port knocker. Good job!

Daemon watching iptables (2, Interesting)

Goodbyte (539941) | more than 10 years ago | (#9856686)

Am I the only one to wonder why the author made a deamon that watches iptable-logs and then modify the ruleset when a matching knock sequence is found instead of implementing a iptables match module instead?

Same goes for psad [cipherdyne.org] (by same author) -- I thought the purpose of iptables was to allow plug-in modules to be COMBINED.

Re:Daemon watching iptables (1)

michaelrash (715609) | more than 10 years ago | (#9857440)

Because certain things should not be implemented within iptables. For example, fwknop [cipherdyne.org] supports encrypted knock sequences with the Rijndael block cipher; psad [cipherdyne.org] supports email alerts to DShield, parsing of Snort rulesets, whois and reverse dns lookups, etc. Such functionality does not belong in iptables itself.

NOT a one-time pad (4, Informative)

Dwonis (52652) | more than 10 years ago | (#9856691)

This is a one-time password system, which uses hashes, just like S/Key does. This is NOT a one-time pad system.

That's good (1)

billstewart (78916) | more than 10 years ago | (#9856864)

One-time password systems make some sense here. One-time pads are operationally awkward and total overkill for the cryptographic needs of this application.

"Security by obscurity" (0)

Anonymous Coward | more than 10 years ago | (#9856709)

To all those who are going to repeat the old "security by obscurity" mantra: there is NO clear distinction between good security and security by obscurity. Much of the mechanisms we implement (including passwords, cryptography and so forth) are based on the concept of keeping certain information needed to access the data secret from the attacker, making it difficult to find out or guess certain parameters.

There are some extreme cases of trivial security by obscurity, which is - indeed - as bad or worse than no security at all. In this case, however, there are security benefits of cryptographically-reinforced port knocking: it makes access to non-public services much more difficult, without the need to deploy complex technologies that are known to cause problems of their own (VPN, for example).

Passive fingerprinting is only a minor twist here, as it only requires the attacker to do more brute-forcing and low-level hacking than he'd otherwise have to do. But then, the Slashdot crowd should not complain something was done only because of the "wow factor" ;-)

Eh? (1)

sakusha (441986) | more than 10 years ago | (#9856732)

I thought port knocking was definitively debunked as security through obscurity.

Re:Eh? (0)

Anonymous Coward | more than 10 years ago | (#9856742)

So let me get this straight:

VPN, a method to grant access to a private infrastructure only if you know the right crypto key and/or password and can prove it: GOOD SECURITY.

Port knocking, a method to grant access to a private infrastructure only if you know the right crypto key and/or password and can prove it: BAD SECURITY.

Re:Eh? (0)

Anonymous Coward | more than 10 years ago | (#9856966)

You're combining the covert channel (port knocking) with a cryptographic authentication scheme. The former is security by obscurity, the latter does not depend on the covert channel (and does not gain from being used over a covert channel either).

One of the dangers of port knocking is that it may result in less diligence regarding security of the application protocols. Port knocking opens ports to remote IP addresses. IP addresses can be spoofed. Port knocking does not encrypt the application protocol. Unencrypted application protocols can be sniffed.

Re:Eh? (0)

Anonymous Coward | more than 10 years ago | (#9857131)

I thought clueless people only repeating after other clueless people trying to sound interesting were definitively debunked as stupid!

Re:Eh? (1)

Tony Hoyle (11698) | more than 10 years ago | (#9857250)

Port knocking seems a bit pointless (even dangerous - I don't run software on my firewall and am not going to start running undested 'knocking' daemons with the ability to open ports... hell, they'll be saying upnp is sane next...)

However security through obscurity is not the reason. Most security is to some extent reliant on obscurity (eg. you can bet there are security bugs in the browser you're using, but nobody knows about them yet). Every time you enter your password to login you're relying on obscurity (unless you're in the habit of posting your password on public websites).

Where obscurity is wrong is where you know about the vulnerability and hope nobody else has guessed it yet, so you try to keep it quiet rather than fix it.

Ruinning open services and using knocking to 'hide' your server is a bad use of security through obscurity (if someone sniffs your knock there's no other layers and you're dead).

Running nothing but an ssh daemon then hiding it behind another layer is a good use (but redundant if you're using PKI to authenticate anyway).

Watching the logs.. (3, Insightful)

Anonymous Coward | more than 10 years ago | (#9856733)

I always considered watching logs to be a very ugly and inelegant way of doing port knocking. Netfilter is stateful, why not make use of it?

Use the recent match module and something like the following for requiring ports 1000, 2000 and 3000 to be knocked in order and within 30 seconds before allowing ssh from a particular host:
iptables -A INPUT -p tcp --dport 1000 -m recent --remove --name PART2
iptables -A INPUT -p tcp --dport 1000 -m recent --remove --name PART3
iptables -A INPUT -p tcp --dport 2000 -m recent --remove --name PART3
iptables -A INPUT -p tcp --dport 1000 -m recent --set --name PART1
iptables -A INPUT -p tcp --dport 2000 -m recent --set --name PART2
iptables -A INPUT -p tcp --dport 3000 -m recent --set --name PART3
iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 30 --name PART1 --name PART2 --name PART3 -j ACCEPT
Now you don't have to clutter the system with logs and a daemon that may run into trouble.

Re:Watching the logs.. (0)

Anonymous Coward | more than 10 years ago | (#9856786)

You should not have posted AC. Now everybody is going to be knocking 1000, 2000, 3000 all over the place. You are contributing to the DOS virus.

Re:Watching the logs.. (1)

michaelrash (715609) | more than 10 years ago | (#9857371)

Yes, but fwknop also offers the following capabilities which cannot (easily) be emulated with iptables rulesets alone:

-encrypted sequences with the Rijndael algorithm
-timing delays (both min and max) between successive ports in a knock sequence

Now... I don't know if this was asked already but. (2, Interesting)

PKC Jess (797453) | more than 10 years ago | (#9856740)

Would this if further developed simply allow a company say, like Microsoft to prevent people who are not using Windows to visit websites? If put on servers that would be trouble for many Linux users. Microsoft could just try to shrug it off saying that its not a "trusted" operating system. Anyone using say, frontpage or Windows Server could effectively just by using those products prevent "those dirty Open Source infidels" from viewing big websites. ...just a thought.

Re:Now... I don't know if this was asked already b (1)

gmanic (761667) | more than 10 years ago | (#9856794)

That did happen before, didn't it?

I don't have the /. story handy nor could I find it with a quick search, though...

Re:Now... I don't know if this was asked already b (0)

Anonymous Coward | more than 10 years ago | (#9856877)

Problem is, a bloody large percentage of webservers run apache as their httpd. Microsoft would need dominion of the server market in order to make this stick, even ignoring the legal side of things.

Nice idea but... (1)

flakac (307921) | more than 10 years ago | (#9856750)

The passive operating system fingerprints are going to prove to be useless in preventing abuse. It boils down to this -- you can't trust any information gained exclusively from the user (even passively).

Writing software to spoof OS characteristics won't prove to be a challenge, esp. when you know what characteristics the other side is trying to detect. I just can't really see this system as bringing any added value at all.

A more interesting twist (1, Interesting)

Anonymous Coward | more than 10 years ago | (#9856757)

Would be to implement invisible port knocking, that is one where there is no preceeding magic packet that would hint the attacker about the presence of port knocker.

You can encode plenty of bits of data into the initial sequence number, TTL, window size, timestamp options and so forth (you can probably stuff a TCP packet with up to 128 bits of data with no effort).

The port knocking daemon could then only allow connections for which this 128 footprint matches the one-time cryptographically generated password, silently dropping all other traffic.

Re:A more interesting twist (1)

eric76 (679787) | more than 10 years ago | (#9857010)

Another possibility would be to send one or more packets that appear to be legitimate answers to legitimate DNS queries.

One of the packets could even identify the particular IP address of the computer from which the connection will be made.

Re:A more interesting twist (1)

michaelrash (715609) | more than 10 years ago | (#9857395)

Yes, that is a cool idea. I would need to use libnet and so the client code would be a bit more complicated, but this would be very interesting to implement.

OpenBSD (4, Informative)

pmf (255410) | more than 10 years ago | (#9856778)

OS detection combined with firewall rules is already implemented [openbsd.org] in OpenBSD.

Security through obscurity? (0)

Anonymous Coward | more than 10 years ago | (#9856810)

I thought we Linuxboys found security through obscurity bad? Make sure your ssh daemon is secured with good passwords and that you are up to date with security patches, that all other ports are closed/firewalled and that should suffice?

Re:Security through obscurity? (0)

Anonymous Coward | more than 10 years ago | (#9856838)

Well, for starters, it is a prudent security practice not to make widely available the services you do not need to.

Then, relying on a single and often faulty defense mechanism (keeping software up to date) is just naive. Reinforce your defences.

Requiring the user to go through a VPN before being able to access any of the systems is one of such options, although VPN software is usually very complex and, if it fails, it will deny much needed access.

Port knocking is a lightweight alternative for encrypted protocols.

Why is port knocking a good idea? (1)

btempleton (149110) | more than 10 years ago | (#9856811)

I mean it seems cute and all, but what does it buy you that, for example, sending a UDP packet with an access code in it (perhaps specific to the time of day and other parameters) doesn't get you?

Re:Why is port knocking a good idea? (0)

Anonymous Coward | more than 10 years ago | (#9856831)

Sending a UDP packet with access code is port knocking.

What a well-implemented port knocking mechanism (that is, cryptographically enforced one) buys you when compared to sending mangled date string, is security.

Re:Why is port knocking a good idea? (2, Informative)

strobert (79836) | more than 10 years ago | (#9856848)

Nothing really. Both techniques can be used to make it so that a "semi-public" service does not have an effectively listening port (I say effective becuase the service is always listening but it is not always reachable) all of the time.

If you have a static sequence, then yes if someone is sniffing the traffic then yes you have s security through obscurity layer in protecting blanket access to your service (for sake of discussion let's say SSH).

But you still have your auth on the SSH service.

The idea beind Port knocking (and the UDP method mentioned in the post I am replying to) is it makes it so that blind port scanning/attack attacks on your network won't find the SSH service nor try attacks against it.

now back to port-knocking vs. udp:
- The UDP approach has a big benefit that your data format you send can be more free-form.
- The down side to UDP is that it is easier to see what the special way to open the server port is via packet sniffing. Of course if you use say changing data that is encrypted so that it can't be (or at least is hard to be) faked, then I think the UDP approach is still better.
- Now with the UDP approach means you do have an extra network service running that could be hit by an attack (say a buffer overflow), whereas with port knocking (implemented by a simple daemon looking at the firewall logs) not as likely to have a remote vulnerability.

So depending on how you implement either there can be pros and cons. But the main goal of either system still remains, you augment your security by making the remote "user" have both the normal auth AND another piece of information (port sequence or magic data to be sent via UDP).

(Note: I am not implying the poster I am replying to doesn't understand the augmenting benefits)

Re:Why is port knocking a good idea? (1)

welsh git (705097) | more than 10 years ago | (#9856858)

> I mean it seems cute and all, but what does it buy you that, for example, sending a
> UDP packet with an access code in it (perhaps specific to the time of day and other
> parameters) doesn't get you?

I'd think it depends on your confidence in the security of the UDP listener.
Granted, it would be a simple piece of code to audit, but you'd still need to
open up the UDP port in the firewall, and expose the "UDP listener" to potential exploits.

Whilst a method that monitors log files is more of a kludge, it would be able to
report knocks to ports that your established firewall software keeps closed..

Ok, this is probably quite an anal reason, but hey, this is slashdot :)

Re:Why is port knocking a good idea? (1)

HermanAB (661181) | more than 10 years ago | (#9856987)

SSH uses TCP, so sending a UDP packet to open the TCP port would be great as an additional access control.

I may be missing something, but port knocking sequences is just a silly waste of time as far as I can see - kinda amateurish actually.

sdIT.slashdot.org (-1, Offtopic)

Anonymous Coward | more than 10 years ago | (#9856818)

shIT.slashdot.org

degauss don't work

somebody stop this

leet Windows users (1)

skinfitz (564041) | more than 10 years ago | (#9857099)

This makes it possible to allow, say, only Linux systems to connect to your SSH daemon.

You mean you could block all the leet blackhat Windows users from your box? You could really be in trouble if they were able to reach it...

Re:leet Windows users (1)

geminidomino (614729) | more than 10 years ago | (#9857116)

Somehow I think using it to block all three of the l33t Windows blackhats is marginally less useful than using it to, say, block millions of 0wn3d windows machines from accessing port 25.

port knocking sounds .. dirty (1)

dj42 (765300) | more than 10 years ago | (#9857139)

Hey baby, you ever had your port knocked by a black hat?

Re:port knocking sounds .. dirty (0)

Anonymous Coward | more than 10 years ago | (#9857423)

...in the pale moonlight?

Naming Schemes ... (1)

Hektor_Troy (262592) | more than 10 years ago | (#9857288)

How long before someone comes up with a port knocker called "Cypher Operated Combination Key Knocker"?

And wasn't he played by Mark Hamill?
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?