Implement SSH port knocking IN linux
Port Knocking is a technique to secure services behind a firewall until a specific knock sequence is given. Once that sequence is given, the IP address that initiated the knock may be allowed to access the service for a short period of time. A knocking server listens to all traffic on an Ethernet (or PPP) interface, looking for special “knock” sequences of port-hits. A client makes these port-hits by sending a TCP (or UDP) packet to a port on the server.
This is a bit paranoid, but it add another layer of security, an attacker will have either to try all ports combinations or know the secret combination (knock) to be able to connect to your SSH daemon for example.
First, you’ll have to be sure to have a port knocking client, or you will be kick out forever of your own server!
- Cygwin/Win32 Knock Client
- Native Win32 Client
- MacOS Client
- You can find of information and a nice list of other knock clients and servers over at http://www.portknocking.org/
Define the secret knocking sequence
I will take the default sequence of knockd as an example
2222:udp 3333:tcp 4444:udp .. but you can add more port and not follow any pattern like above.
Install a Knocking server on OpenSuSE
As root of course
sudo apt install knockd
Change the configuration file
vi /etc/knockd.conf
Below is the default content
[options]
UseSyslog
[opencloseSSH]
sequence = 2222:udp,3333:tcp,4444:udp
seq_timeout = 15
tcpflags = syn,ack
start_command = /usr/sbin/iptables -I INPUT 1 -s %IP% -p tcp --dport ssh -j ACCEPT
cmd_timeout = 10
stop_command = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport ssh -j ACCEPTWhich is quite readable:
- A wrong knock expire after 15 seconds
- A successful knock, open for 10 seconds the firewall. The daemon will open a hole for the knocking %IP% source on port 22 (ssh), plenty of time for you to connect!
- start_command add an IPTABLE rule in the firewall to allow the connection while
- stop_command close the connection
Starting the daemon
Check first if there is not any conflicting ssh rules
iptables -L | grep ssh
Start the server
rcknockd start
and monitor the logs file
tail -f /var/log/knockd.log
You can now install a knock client..
Install a knocking client under windows
I’ll use the command line client, put the following in a .bat or .sh file
knock.exe -v myserverIP 2222:udp 3333:tcp 4444:udp
then run it once. You now have 10 second to open a ssh session with either Putty
PuTTY is an SSH and telnet client, developed originally by Simon Tatham for the Windows platform. PuTTY is open source software that is available with source code and is developed and supported by a group of volunteers.
You can download PuTTY here.
or Cygwin ssh.
Cygwin is a Linux-like environment for Windows. It consists of two parts:
- A DLL (cygwin1.dll) which acts as a Linux API emulation layer providing substantial Linux API functionality.
- A collection of tools which provide Linux look and feel.
And under the iPhone?
Luckily there is a FREE application for that! iPhone Knock Client
