Hacker News Reader

Comment by BrentOzar | Hacker News Reader

Simplified example: to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports. It’s kinda like doing a secret knock on a series of doors in a neighborhood before an entirely new door opens up in the side of a building.

And if you knock blindly on a few doors, the system knows you’re an intruder, and no soup for you even if you stumble into the right knock sequence.

View on HN

>>to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports

AKA port knocking[1], minus the special twist at the end where an intrusion/network detection system (IDS or NDS) automagically detects failed port knocks and responds accordingly.

[1] https://en.wikipedia.org/wiki/Port_knocking

I used to use portsentry in a similar way, but this looks interesting as a preset sequence of port knocks, rather than shitcanning any client that steps on a landmine port.

Why not just a password? (you can also lock out after X incorrect attempts) I don't see benefits except for additional security through obscurity factor, which crypto wisdom dictates should not be relied upon.

Security through obscurity is a very misunderstood concept. It should never be used at the expense of proper security (i.e. rolling your own crypto), and you should always act under the assumption that targeted attackers can see through your obscurity, but it can be a valuable part of defense in depth: especially against unskilled attackers.

Consider an 0day for example. When the 0day is published, attackers are going to mass-scan the internet for vulnerable applications. Your WAFs, etc won't yet block the attack, and if you have a vulnerable application that must be externally facing, you may get hit by this mass-scan. If your applications are protected with port knocking, however, you'll have that extra window of time to apply patches and protect yourself before you're directly targeted.

Well, but if port knocking was a great effective security tool, everyone would be using it, which defeats the obscurity advantage and would bring it back on par with good old passwords.

It might be a decent extra tool for very delicate situations, but I find it reasonably clear that it's largely self-defeating and not to be relied upon. It can also introduce further bugs.

I can see it could have an appeal as a proper password system though (not an obscurity device), since it's really the first step in interacting with a server. With password protocols, you usually have a more complicated interaction that can open a greater surface area. It seems good practice to authenticate absolutely as soon as possible.

The benefit of port knocking is that it essentially gives you a channel to transmit a password over, without revealing the existence of the system that's being authenticated for. A traditional password, on the other hand, requires some sort of socket that leaks the presence of a listening server.

Even if everybody were to use port knocking, knowing that fact doesn't give you any knowledge about whether a given IP hosts zero, one, or some arbitrary number of possibly vulnerable services.

"If this was good everyone would be doing it" is... shaky logic, at best.

I think the intent is an argument that basically says "if everyone were doing it, it wouldn't be good" which is less shaky (though see ShaneWilton's comment as to why this isn't so).

One clear downside: you've now created an easy low-bandwidth way for anyone to deny you from opening connections there, since others can easily interfere with your port knocking sequence.

Guys, try reading the linked article first? This is just an example on a state machine and the linked article is on how to model them. It has nothing at all to do with port knocking.

Having not heard of this Analysis Design Matrix thing before, it was not clear to me what the linked article was going on about. From the home page, I read that "Matrix is a fundamentally new conceptual framework for thinking about Software Engineering and Model Compiler development", though at first sight, it looks very 1990s / CASE - like. It is perhaps unfortunate that the introduction page contains a 45-line "hello world" program, as this presumably does not show its intended purpose.

What you're reading here is the second example model based on Martin Fowler's original model. It's one of a series of demo models that shows off the Matrix modeling language.

A theme of the site is to push the idea generating code from models by using Model Compilers to continuously improve and optimise future Model Compilers as shown graphically in the Analysis Design Matrix Diagram.

Maybe I am missing something, but wouldn't this be vulnerable to a man in the middle attack?

not if the sequence changes based on some predetermined pattern

Hmmmm. I don't know if I buy that. If the pattern is not cryptographically secure, then you're still vulnerable to man in the middle, and if it is cryptographically secure, wouldn't you get roughly the same security by just doing standard SSH key based auth?

Isn't the point to have some defense in depth, so if there is a zero-day exploit found for your SSH authentication, you are not wide open? In a way like the grooves on a key for a pin-tumbler lock.

That would cover a replay attack, but not a man in the middle attack (as the mitm would just intercept the new port knock pattern.)

Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting attempts at replaying a previous knock.

Edit: Sorry I misread your comment as talking about replay attacks, not MITM'ing. I'm not an expert, but I believe MITM attacks are typically mitigated by performing the knock out of band over a covert channel (DNS, etc). AFAIK, there isn't really a way to prevent them entirely.

Yes, relying on port-knocking as your only authentication layer is not recommended; it's useful as a "front gate" to some other system.

to me it sounds like a typical safe lock - 2 turns left, 3 and half right, ...

>to send specific packets in a specific sequence on specific ports.

like Gothic Motel model itself it looks like an unnecessary complication. I think we can get pretty much the same effect if typical password (its hash) was sent in a sequence of say 10 packets instead of 1.

Reply on news.ycombinator.com