Hacker News

points by Gigachad 2 days ago | 0 comments

Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address.

[–] icedchai 2 days ago

Just moving SSH off a default port gets you 98% there.

[–] LoganDark 2 days ago

An attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own.

[–] icedchai 2 days ago

I mostly do it to quiet down the noise from the non-stop bots and scanners.

[–] LoganDark 2 days ago

Being off the IPv4 space completely can be even more effective at that, FWIW, but that can have other issues. Only feasible for some!

[–] esseph 2 days ago

LLMs port knock for redteam scans. Have for a long time.

[–] LoganDark 2 days ago

My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.

[–] esseph 2 days ago

That's not a knock, it's a password :-)

[–] LoganDark 2 days ago

I mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...

[–] dns_snek 1 day ago

Yes something like that has been done, the solution uses asymmetric cryptography instead of symmetric and it protects the entire communication stream instead of just opening the gates - it's called Wireguard.

I jest, but you're describing authentication protocol which uses the UDP destination port field to carry each character of the "one time password" in a roundabout way. You could simply send 1 packet containing the password to the daemon.

I've never seen it used in the wild but apparently, it exists: https://github.com/mrash/fwknop

[–] ilikepi 3 hours ago

Yep, we used fwknop for several years at work, back when it was written in perl. And now we use Wireguard.

[–] LoganDark 1 day ago

LOL'd at Wireguard, but I really miss Plan 9-style networking, where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that.

Reading the fwknop README is such a breath of fresh air, thank you for that treat. I hate AI-generated documentation so much.

[–] SV_BubbleTime 2 days ago

That’s cute. Have Claude do it. There is already an echo system of TOPT QR to communicate it, so you would just need to convert your six digit code to two or more hits on the 16bit port range.

I’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.