Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can port knocking be used in the "real world"? In other words, would ~/.ssh/config or some other setting be able to automate the sequence?

I'm picturing some current workflows I use if port knocking was enabled.

In particular, unless there's a way to automate the knocking sequence, SSH'ing in via Ansible would be an issue and a SaaS we use to help with deployments would no longer work.

(Altho I'd imagine making firewall exception rules (e.g. "allow this ip address in") for these services would be a way around that).



I used to use something like this in ~/.ssh/config :

  Host Box
  Proxycommand ~/bin/do_knock %h %p
Where do_knock was simply

  #!/bin/sh
  host=$1
  port=$2

  knock $host 1 2 3 4 5
  nc $host $port && exit
  knock $host 1 2 3 4 5
  sleep 1.5
  nc $host $port
Simply, but it worked well enough for a few years.

On android I used to port knocking app that integrated with connectbot, so I had one tap access to the host.


Yes, it's off-the-shelf tech now. For example, see http://www.zeroflux.org/projects/knock

It's perhaps not as slick as you might hope, but it should be enough to shell script up some things.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: