Hacker News Reader

Port-knocking is a PITA in theory and even worse in real world : people do not have time nor the will to do wild invocations before getting job done.

Unless you are talking about your own personal use-case, in which case, feel free to follow your deepest wishes

Firewall is a joke, too. Who can manage hundreds and thousands of even-changing IP ? Nobody. Again: I'm not talking about your personal use-case (yet I enjoy connecting to my server through 4G, whereever I am)

Fail2ban, on the other hand, is nice: every systems that relies on some known secret benefits from an anti-bruteforce mechanism. Also, and this is important: fail2ban is quick to deploy, and not a PITA for users. Good stuff.

I’ve written a few toy port knocking implementations, and doing it right is hard.

If your connections crap and there’s packet loss, some of the sequence may be lost.

Avoiding replay attacks is another whole problem - you want the sequence to change based on a shared secret and time or something similar (eg: TOTP to agree the sequence).

Then you have to consider things like NAT…

Also, if you are trying to connect to a resource from a restrictive network your knocking sequence might be blocked by filters at the client end.

I've been on networks that allow nothing except the standard TCP & UDP ports for HTTP(S), SSH and DNS (and even then DNS was restricted to their local name server).

I am interested in any tools for managing IP allow lists on Azure and AWS. It seems like there should be something fairly polished, perhaps with an enrollment flow for self-management and a few reports/warnings...

> […] rendered unusable for attackers by using port knocking.

Port knocking renders SSH unusable: I'm not going to tell my users "do this magic network incantation before running ssh". They want to open a terminal and simply run ssh.

See the A in the CIA triad, as well as U in the Parkerian hexad.

What benefits does port knocking give over and above a simple VPN? They're both additional layers of authentication, except a VPN seems much more rigorous and brings potentially other benefits.

In a world where tailscale etc. have made quality VPNs trivial to implement, why would I both with port knocking?

VPNs drop your bandwidth speeds by 50% on average. And if tailscale has to use a relay server, instead of a direct connection, bandwidth will drop by 70-80%.

>VPNs drop your bandwidth speeds by 50% on average

Source? Wireguard can do 1GB/s on decade old processors[1]. Even openvpn can do 258 Mb/s, which realistically can saturate the average home internet connection. Also, if we're talking about SSH connections, why does throughput matter? Why do you need 1 gigabit of bandwidth to transfer a few keystrokes a second?

[1] https://www.wireguard.com/performance/

We ran iperf on our multi-cloud and on prem network.

> Also, if we're talking about SSH connections, why does throughput matter?

scp, among other things, runs over ssh.

>scp, among other things, runs over ssh.

Ironically scp/sftp caused me more bandwidth headaches than wireguard/openvpn. I frequently experienced cases where scp/sftp would get 10% or even less of the transfer speed compared to a plain http(s) connection. Maybe it was due to packet loss, buffer size, or qos/throttling, but I wasn't able to figure out a definitive solution.

In almost all cases, the reason is OpenSSH's silly limitation of buffer sizes [1].

It limits the amount of data that's "in the cable" (which needs to be more if the cable is long).

> The default SSH window size was 64 - 128 KB, which worked well for interactive sessions, but was severely limiting for bulk transfer in high bandwidth-delay product situations.

> OpenSSH later increased the default SSH window size to 2 MB in 2007.

2 MB is still incredibly little.

It means that on a 100 ms connection, you can not exceed 160 Mbit/s, even if your machines have 10 Gbit/s.

OpenSSH is one of the very few TCP programs that have garbage throughput on TCP. This is also what makes rsync slow.

The people from [1] patched that.

You can support that work here: https://github.com/rapier1/hpn-ssh

In my opinion, this should really be fixed in OpenSSH upstream. I do not understand why it doesn't just use normal automatic TCP window size scaling, like all other TCP programs.

All the big megacorps and almost every other tech company in existence uses SSH, yet nobody seems to care that it's artificially 100x slower than necessary.

[1]: http://www.allanjude.com/bsd/AsiaBSDCon2017_-_SSH_Performanc...

You can help by testing/reviewing https://github.com/djmdjm/openssh-wip/pull/29/commits/659cbc...

Awesome!

I asked my "why not upstream" question here and got a response:

https://github.com/rapier1/hpn-ssh/issues/89#issuecomment-22...

Port-knocking is way simpler and relies on extremely basic network primitives. As such the attack surface is considerably smaller than OpenSSH or OpenVPN and their authentication mechanisms.

Are you assuming that VPNs are more secure than ssh?

No?

Yes, inherently yes. Because they have a lot less features than SSH.

It's in the name; Secure Shell, vs. Virtual Private Network. One of them has to deal with users, authentication, shells, chroots. The other mostly deals with the network stack and encryption.

Port knocking is a ludicrous security measure compared to the combination of: * configuring sshd to only listen over a Wireguard tunnel under your control ( or letting something like Tailscale set up the tunnel for you) * switching to ssh certificate authn instead of passwords or keys

Does Wireguard work in such a way that there is no trace of its existence to an unauthorized contacting entity?

I used port knocking for a while many years ago, but it was just too fiddly and flaky. I would run the port knocking program, and see the port not open or close.

If I were to use a similar solution today (for whatever reason), I'd probably go for web knocking.

In my case, I didn't see it as a security measure, but just as a way to cut the crap out of sshd logs. Log monitoring and banning does a reasonable job of reducing the crap.

That's one of the original design requirements for wireguard. Unless a packet is signed with the correct key, it won't respond at all.

I use port knocking to keep my ssh logs clean. I dont think it adds security (I even brag about using it in public). It allows me to read ssh's logs without having to remove all the script kiddie login attempt spam.

Saying you use it publicly doesn't defeat the security it gives though. Unless you publicly say the port knocking sequence. Which would be crazy.

I meant to say: I dont use it for security, I use it for convenience.

Those not notoriously exploitable were those using gated ssh access only via known IPs or connecting via tailnets/vpn.

Port knocking works if you have to ssh to your servers, there are many solutions that obviate even that, and leave you with no open ports, but a fully manageable server. I'm guilty of ssm in aws, but the principal applies - the cattle phone home, you only have to call pets.

Sure, if you can't afford a more robust access control to your SSH server and for some reason need to make it publicly available then port knocking etc. can be a deterring feature that reduces the attack rate.

Camouflage is after all one of nature's most common defenses. Always be quick with patching, though.

I put all my jank behind wireguard

> I don't use port-knocking but I really just don't get all those saying: "It's security theater".

It's not security theater but it's kind of outdated. Single Packet Authentication[0] is a significant improvement.

> How many exploits rendered cold dead in their tracks by port-knocking shall we need before people stop saying port-knocking is security theater?

Port knocking is one layer, but it shouldn't be the only one, or even a heavily relied upon one. Plenty of people might be in a position to see the sequence of ports you knock, for example.

Personally, I think if more people bothered to learn tools like SELinux instead of disabling it due to laziness or fear, that is what would stop most exploits dead. Containers are the middleground everyone attached to instead, though.

[0] https://www.cipherdyne.org/fwknop/docs/SPA.html