Wireguard doesn’t respond to malformed packets or handshakes from unknown devices by design.
replyOh, awesome!
replyIs there a way to automate port knocks in your .ssh/config? I think that’s the main reason why I haven’t added it to my home server.
replyTechnically you could use a ProxyCommand that does the knock and then runs nc to your target.
replyPort knocking is idiotic and amounts to Biff Tannen's "only I know how to start this car".
replyDunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address.
replyJust moving SSH off a default port gets you 98% there.
replyAn attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own.
replyI mostly do it to quiet down the noise from the non-stop bots and scanners.
replyBeing off the IPv4 space completely can be even more effective at that, FWIW, but that can have other issues. Only feasible for some!
replyLLMs port knock for redteam scans. Have for a long time.
replyMy knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.
replyThat's not a knock, it's a password :-)
replyI mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...
replyYes something like that has been done, the solution uses asymmetric cryptography instead of symmetric and it protects the entire communication stream instead of just opening the gates - it's called Wireguard.
replyI jest, but you're describing authentication protocol which uses the UDP destination port field to carry each character of the "one time password" in a roundabout way. You could simply send 1 packet containing the password to the daemon.
I've never seen it used in the wild but apparently, it exists: https://github.com/mrash/fwknop
That’s cute. Have Claude do it. There is already an echo system of TOPT QR to communicate it, so you would just need to convert your six digit code to two or more hits on the 16bit port range.
replyI’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.
deleted
replyIt's more like "only I know how to find this keyhole". You still need the key then, you're just also adding some defense against picking.
replyIt would be idiotic to use the knock as the only authentication, which is why I don't.
To be quite honest, I just like the aesthetics of it.
You're sending your knock over the public network in the clear. It's observable by anything in the path. And then you're not the only one that can find the keyhole.
replyEntirely true, it's not true security, same as changing the ssh port. So, relying on it for any security is not useful but it's a good deterrent from automated scans that are not targeted towards you. Defense in depth means not necessarily discarding flawed defenses if they are in addition to proper defense.
reply