Select Page

Implement SSH port knocking IN linux

Implement SSH port knocking IN linux

Port Knocking is a technique to secure services behind a firewall until a specific knock sequence is given. Once that sequence is given, the IP address that initiated the knock may be allowed to access the service for a short period of time. A knocking server listens to all traffic on an Ethernet (or PPP) interface, looking for special “knock” sequences of port-hits. A client makes these port-hits by sending a TCP (or UDP) packet to a port on the server.

This is a bit paranoid, but it add another layer of security, an attacker will have either to try all ports combinations or know the secret combination (knock) to be able to connect to your SSH daemon for example.

First, you’ll have to be sure to have a port knocking client, or you will be kick out forever of your own server!

Define the secret knocking sequence

I will take the default sequence of knockd as an example

2222:udp
3333:tcp
4444:udp
.. but you can add more port and not follow any pattern like above.

Install a Knocking server on OpenSuSE

As root of course

sudo apt install knockd

Change the configuration file

vi /etc/knockd.conf 

Below is the default content

[options]

        UseSyslog

[opencloseSSH] 
        sequence      = 2222:udp,3333:tcp,4444:udp 
        seq_timeout   = 15 
        tcpflags      = syn,ack 
        start_command = /usr/sbin/iptables -I INPUT 1 -s %IP% -p tcp --dport ssh -j ACCEPT 
        cmd_timeout   = 10 
        stop_command  = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport ssh -j ACCEPT

Which is quite readable:

  • A wrong knock expire after 15 seconds
  • A successful knock, open for 10 seconds the firewall. The daemon will open a hole for the knocking %IP% source on port 22 (ssh), plenty of time for you to connect!
  • start_command add an IPTABLE rule in the firewall to allow the connection while
  • stop_command  close the connection

Starting the daemon

Check first if there is not any conflicting ssh rules

iptables -L | grep ssh

Start the server

rcknockd start

and monitor the logs file

tail -f /var/log/knockd.log

You can now install a knock client..

Install a knocking client under windows

I’ll use the command line client, put the following in a .bat or .sh file

knock.exe -v myserverIP 2222:udp 3333:tcp 4444:udp

then run it once. You now have 10 second to open a ssh session with either Putty

PuTTY is an SSH and telnet client, developed originally by Simon Tatham for the Windows platform. PuTTY is open source software that is available with source code and is developed and supported by a group of volunteers.

You can download PuTTY here.

or Cygwin ssh.

Cygwin is a Linux-like environment for Windows. It consists of two parts:

  • A DLL (cygwin1.dll) which acts as a Linux API emulation layer providing substantial Linux API functionality.
  • A collection of tools which provide Linux look and feel.

And under  the iPhone?

Luckily there is a FREE application for that!  iPhone Knock Client

port.knocking.iphone

About The Author

I worked with various Insurances companies across Switzerland on online applications handling billion premium volumes. I love to continuously spark my creativity in many different and challenging open-source projects fueled by my great passion for innovation and blockchain technology.In my technical role as a senior software engineer and Blockchain consultant, I help to define and implement innovative solutions in the scope of both blockchain and traditional products, solutions, and services. I can support the full spectrum of software development activities, starting from analyzing ideas and business cases and up to the production deployment of the solutions.I'm the Founder and CEO of Disruptr GmbH.

Categories