The sys admin's daily grind: Single-packet authentication
Key Experience
Conventional, woodpecker-style port knocking is open to sniffing and brute force knocking attacks. Sending an encrypted packet with an access request to the server is safer and more modern. Learn more about Firewall Knock Operator, a.k.a. Fwknop.
Conventional port knocking, which I described last month [1], protects you against attackers who routinely scan whole networks looking for "low-hanging fruit." A cracker who takes more time and logs communications can also identify knocking signals because the sequences will repeat.
In theory, you might consider using lists of one-off knocking signals that become obsolete after use. Unfortunately, this is really complex. Besides, if the administrator is not creative enough, an attacker could just try out popular knocking sequences (port 7000, 8000, 9000, …) to gain access.
Single-Packet Authentication (SPA) is one possible solution. The knocking system sends a single packet containing the encrypted authentication credentials – typically a pass phrase – and the client request to open a specific port. An SPA implementation that works really well is Firewall Knock Operator, or Fwknop [2]. Besides the normal build tools, the installation requires Perl, the libpcap-dev package, and the CPAN Net::Pcap module. After installing all of these resources, installing Fwknop is a breeze thanks to the Perl-based installer.
[...]
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
US / Canada
UK / Australia