Portknocking

Introduction

Port knocking is a technique used to secure network access by opening ports that are otherwise closed. It works by having a client send a sequence of connection attempts to a series of ports on a remote server, triggering the server to open a specific port for access. Once the correct sequence is sent, the server will allow the client to connect to the designated port.

For example: Suppose you have a web server that is configured to only allow SSH access on port 22. You want to add an extra layer of security by implementing port knocking. You decide to use a sequence of three ports: 1000, 2000, and 3000.

To access the SSH port, the client needs to send connection attempts to these ports in the correct order. For example, the client might first send a connection attempt to port 1000, then port 2000, and finally port 3000. If the correct sequence is followed, the server will detect the pattern and open port 22, allowing the client to connect via SSH.

In this way, port knocking can be used to add an extra layer of security to network access, by making it more difficult for unauthorized users to gain access to open ports.

Enabling

To use the portknocking engine you will need to enable portknocking in AEO. Please see this option to enable the engine in the UI: Hub Configuration > Firewall > Port Knocking

And then follow the instructions in this document to configure portknocking for your system.

Modes

AEO has two modes for portknocking, the “simple” and “advanced” modes. You can use either, or both of them at the same time. You can not, however, use both method to protect the same port.

Simple:

  • The simple mode, or “classic” allows you to define a series of “knock” ports to connect to via TCP to open a closed port. For example, you can set port 22 to be closed, and open port 22 by connecting to ports 1,2,3,4 and 5 via TCP. You can use either a portknocking client, or telnet to “knock” on the ports.

Advanced

  • The advanced mode allows you to send a One Time Password on a special port to open a closed port. This helps to prevent replay attacks against the “classic” port knocking method where if an attacker could see your knock sequence, via a sniffer, they could repeat the sequence and also open the port.

Note

Remember that these are One Time Passwords, so you can not reuse the same hmac, letting you knock just once per minute (because of the epoch_min).

Configuration via CLI

Once you have port knocking enabled, as described above, you will then need to configure the ports to protect, and the knock ports and optionally the open and close secrets that will be used to generate the One Time Password.

Simple Mode Configuration:

Step 1: Enabling the portknocking engine by setting FW_PORTKNOCK

Step 2: Enable Simple portknocking by setting FW_PORTKNOCK_SIMPLE

Step 3: Create this file:

/var/awp/etc/firewall/simple-portknock-list

A single line for each port. For example,

22:1,2,3,4,5
23:7,8,9,10,11

The port number list represents the ports that must be “knocked”, and the order in which the knock must occur. In the example above the sequence for port 22 is 1,2,3,4,5. If you were to connect out of sequence, 1,2,5,3,4 the knock would not be recognized. Think of this as a “combination lock” for the port. The order also matters.

Step 4: Implement the new firewall rules by running the following command as root

awp -s  -f

Advanced Mode Configuration:

Step 1: Enable the portknocking engine by setting: FW_PORTKNOCK

Step 2: Enable advanced portknocking by setting: FW_PORTKNOCK_ADVANCED

Step 3: Create this file:

/var/awp/etc/firewall/advanced-portknock-list

A single line for each port. For example:

22,2000,hipjazz,superawesome
23,2001,elite,october

Step 4: Implement the new firewall rules by running the following command as root

awp -s -f

Note

The simple and advanced formats are delimited differently, on purpose, to help prevent accidentally mixing the two files up. They are not compatible with each other.

Using Portknocking

Once you have your portknocking configuration enabled and configured, then you can start using the portknocking system. Each time you want to connect to a port that you have configured to be protected with portknocking you will need to send the “knock” sequence. This section describes how to do this.

Simple Mode:

Lets say you configured AEO to protect port 22, and to only allow access to it if you connect to ports 2002, 2001 and then 2004. In that order. You can do this by using a simple tool like telnet to connect to these ports. Keep in mind that the telnet connection will not complete, because nothing is listening on those ports, so all you want is for the initial connect attempt to occur. Then kill the telnet and start the next one. For example:

$ telnet yourserver 2002 # first knock
$ telnet yourserver 2001
$ telnet yourserver 2004 # last knock
$ ssh user@yourserver

Advanced Mode:

  • AEO includes an advanced portknocking client that works on systems with bash and python-crypto installed.

Step 1: Your time on your client and on your server must be synced. The advanced knock uses time as part of the One Time Password. OTPs are are only good for 60 seconds, and time synchronization is vital to ensure that your OTP will work. To sync your server, if your server is not already synced via a good well configured NTP daemon, you can use the rdate command. As root run these commands:

rdate time-a.nist.gov
/sbin/hwclock --systohc

Step 2: Open the port with your open knock secret. On the client, run the knocking tool like this:

knock.sh <dst> <PORT dst> <open_secret>

For Example:

  knock.sh 192.168.0.1 2000 your_opensecret

Step 3: Connect to the port

Step 4: close the port

knock.sh <dst> <PORT dst> <close_secret>