Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4943

Re: Connecting to an SSH server from the external world

Show all headers | View raw

On 2021-06-14, William Unruh <unruh@invalid.ca> wrote:
> On 2021-06-14, Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>> On 6/14/21 8:34 AM, Pascal Hambourg wrote:
>>> Of course it does.
>>
>> I agree with William.  I don't believe that each individual source IP 
>> needs individual port knock sequences.
>>
>>> You don't want to allow your "neigbour" which is eavesdropping on 
>>> your traffic to replay the port knocking sequence you just sent.
>>
>> I don't care about my neighbor.  I care about random malware not being 
>> able to get to my SSH daemon.
>>
>> There's also the fact that my neighbor - who's not on my LAN - is going 
>> to have trouble eavesdropping on the port knock sequence.
>>
>>> This is exactly what we are discussing in that part of the thread : port 
>>> knocking implemented with iptables as someone suggested.
>>
>> Which is entirely possible to do, especially with loose granularity. 
>> I've done it multiple times.
>>
>>> No, you need different one rule per single address to prevent port 
>>> knocking replay.
>>
>> Not if you don't care about knock reply.
>>
>> It really depends on what you're trying to use port knocking to protect 
>> against.  If you're trying to simply reduce noise from SSH brute force 
>> attempts, then you very likely don't care about knock reply protection. 
>> If you're trying to protect against someone else in the coffee shop 
>> replaying and attacking you personally, well, a port knock sequence no 
>> matter how complex, probably won't suffice and you need a different 
>> solution.
>>
>>
>
> You could also do something like. "knock on port A, where you do not
> care if anyone knows port A." That triggers a subrouting on both your
> travel machine and your home machine to encrypt the IP address your
> remote machine and use that to determine a port number for the next
> knock. Both the home machine and the touring one use the same key for
> the encryption so both know, but noone else does, what the next port is
> to knock at. So you then knoch on that port, and the ssh port is then
> opened. (or even use that encrypted port as the ssh port). To prevent
> replay, the encryption mixes the current UTC (to the nearest minute say) 
> time with the IP address to encrypt to find the next port. You also do
> not let in another attempt on that port in that minute, to prevent
> replay. Ie, if you screw up, say your ssh password at logon. You have to
> wait a minute to try again, but then who says security is a free ride:-)
>
>>

So. Make sure both machines are running chrony or ntp to make sure that
both have the system time accurate to a minute say.

Port K on the home machine simply runs a little program which reflects
back the IP address that it sees coming in. That is to make sure that
you know what your own IP address is on the mobile machine. You now
concatente that IP address with the the time to the minute, hash is with
some suitable hash, encrypt it with some encryption routing and common
password and connect to the home machine on the port corresponding to
the 1000+last six bits of that encryption. Meanwhile the home machine
has done the same-- hashed the concatenationof the incoming IP with the
time to the nearest minute and encrypted it with the encryption with the
common password, and started sshd on that port. Now the remote machine
connects to that port as usual. Then  sshd no longer
responds to that port. If there is a second knock on the port with on
the same date, the knock port does not respond. This means a replay will
not work. This also makes the port as secure as the two passwords (one
the knock password, and the other the ssh password).

The knock program is extremely simple, so its security can be assured
(It just listens, reflects back the incoming IP, and encrypts the
incoming IP and starts sshd on the resultant port number, and refuses to
respond to any more knocks until the minute has passed.  That program
should be able to guarentee security of. Then one still has to log onto
ssh with the ssh logon security.

Then one still has the security of ssh.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-28 21:31 +0000
  Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-28 22:28 +0000
    Re: Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-29 14:38 +0000
      Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-05-29 17:19 +0200
        Re: Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-29 16:27 +0000
      Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-29 15:27 +0000
        Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:46 -0600
      Re: Connecting to an SSH server from the external world Richard Kettlewell <invalid@invalid.invalid> - 2021-05-30 14:42 +0100
      Re: Connecting to an SSH server from the external world pk <pk@pk.invalid> - 2021-05-30 16:31 +0200
  Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-28 16:36 -0600
    Re: Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-29 14:42 +0000
      Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-29 18:44 +0200
      Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:37 -0600
  Re: Connecting to an SSH server from the external world Henning Hucke <h_hucke+spam.news@newsmail.aeon.icebear.org> - 2021-05-29 07:17 +0000
    Re: Connecting to an SSH server from the external world "D. Stussy" <spam@spam.org> - 2021-05-29 20:34 -0700
      Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-05-30 12:51 +0200
        Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-31 22:48 -0600
          Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-01 18:42 +0200
            Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-01 14:46 -0600
              Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-03 12:50 +0200
                Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-03 22:53 -0600
                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-05 19:25 +0200
                Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-05 16:38 -0600
                Re: Connecting to an SSH server from the external world "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-06-05 18:58 -0400
                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-12 11:16 +0200
                Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-12 11:12 -0600
                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-13 13:55 +0200
                Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-13 10:40 -0600
                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-14 16:29 +0200
                Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-14 11:32 -0600
                Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-06-13 17:55 +0000
                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-14 16:34 +0200
                Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-14 11:39 -0600
                Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-06-14 21:03 +0000
                Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-06-14 22:26 +0000
      Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-31 22:45 -0600
  Re: Connecting to an SSH server from the external world Richard Kettlewell <invalid@invalid.invalid> - 2021-05-29 08:55 +0100
  Re: Connecting to an SSH server from the external world Giovanni <lsodgf0@home.net.it> - 2021-05-29 11:01 +0200
    Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-29 18:44 +0200
      Re: Connecting to an SSH server from the external world Giovanni <lsodgf0@home.net.it> - 2021-05-29 19:14 +0200
        Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-29 18:21 +0000
          Re: Connecting to an SSH server from the external world Roger Blake <rogblake@iname.invalid> - 2021-05-29 21:28 +0000
            Re: Connecting to an SSH server from the external world Johann Beretta <beretta@nun-ya-bizness.com> - 2021-05-29 22:03 -0700
              Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-05-30 13:02 +0200
                Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 19:35 +0200
                Re: Connecting to an SSH server from the external world Johann Beretta <beretta@nun-ya-bizness.com> - 2021-08-11 11:48 -0700
          Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:41 -0600
            Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-30 14:43 +0000
              Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-31 10:22 +0200
                Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-31 17:29 +0000
          Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 12:12 +0200
        Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 12:11 +0200
      Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:48 -0600
        Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 12:13 +0200
  Re: Connecting to an SSH server from the external world "Carlos E.R." <robin_listas@es.invalid> - 2021-05-29 20:56 +0200
    Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:44 -0600

csiph-web