Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There are well known benefits of Port Knocking utilities when utilized in combination with firewall IP table modification. Port Knocking is best used to provide an additional layer of security over other tools such as the OpenSSH server. I would like some help setting it up on a ubuntu server.

I looked at some port knocking implementations here:
PORTKNOCKING - A system for stealthy authentication across closed ports. IMPLEMENTATIONS
http://www.portknocking.org/view/implementations

fwknop looked good. I found an Android client here. And fwknop (both client and server) is in the ubuntu repos.

Unfortunately, setting it up (on the server) looks difficult. I do not have iptables set up. My proficiency with iptables is limited (but I understand the basics). I'm looking for a series of simple steps to set it up. I only want to open the SSH port in response to a valid knock.

Alternatively, I would consider other port knocking implementations, if they are much simpler to set up and the desired Linux and Android clients are available.

share|improve this question
    
"I do not have iptables set up." If you're running any mainstream Linux distro then you do. –  Ignacio Vazquez-Abrams Apr 12 '12 at 3:48
    
If you have those rules then setting up portknocking is the second step... –  Ignacio Vazquez-Abrams Apr 12 '12 at 3:56
    
@IgnacioVazquez-Abrams-True. I meant I have not customized the rules in any way. It is installed, but not really "set up" in the sense of having rules that would create any level of security. The rules are empty: Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination –  Ace Paus Apr 12 '12 at 4:08

1 Answer 1

For what its worth I stumbled across a blog post talking about how port knocking is not necessarily all that it is cracked up to be. However, the author does go through a few ways to set port knocking up describes some alternatives.

Here is a quote from the blog post.

But first impressions are not always correct. First, please take one step back and explain to me what problem this is supposed to solve. If the answer is the old canard "all the insecurities of that horrible SSH protocol", I will ask you to please point out to me just what those are, and if you will, describe which parts of what I am about to describe actually adds value (that's "security" to you) in a real life scenario.

I suppose this post and will be most useful if you are using similar OS but may still be a good reference guide nonetheless.

Here is the article

share|improve this answer
1  
Port knocking is controversial. I personally understand the pros and cons, but if someone doesn't, they should read up. Port knocking is not a great security approach on its own. But I feel it adds something important on top of the other approaches I am using. I'm just looking for a less complicated way to set up it. –  Ace Paus Apr 12 '12 at 21:34
1  
@jmreicha-regarding the article you linked: why is that guy writing in 2012 about 2006 bugs in port knocking that were solved long ago? He seems to have an axe to grind. I don't see the point in even reading the whole article. There's better stuff on port knocking available elsewhere. –  Ace Paus Apr 12 '12 at 21:43
    
I guess I was just trying to point out the fact that port knocking is controversial, as you said. Since you already know the pros and cons I realize the article isn't what you're looking for. Have you looked at knockd, it looks like it might be worth looking into? –  jmreicha Apr 13 '12 at 14:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.