Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4882 > unrolled thread

Connecting to an SSH server from the external world

Back to article view | Back to comp.os.linux.networking

Contents

  Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-28 21:31 +0000
    Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-28 22:28 +0000
      Re: Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-29 14:38 +0000
        Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-05-29 17:19 +0200
          Re: Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-29 16:27 +0000
        Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-29 15:27 +0000
          Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:46 -0600
        Re: Connecting to an SSH server from the external world Richard Kettlewell <invalid@invalid.invalid> - 2021-05-30 14:42 +0100
        Re: Connecting to an SSH server from the external world pk <pk@pk.invalid> - 2021-05-30 16:31 +0200
    Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-28 16:36 -0600
      Re: Connecting to an SSH server from the external world John Smith <12345@whatismyemailaddress.xyz> - 2021-05-29 14:42 +0000
        Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-29 18:44 +0200
        Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:37 -0600
    Re: Connecting to an SSH server from the external world Henning Hucke <h_hucke+spam.news@newsmail.aeon.icebear.org> - 2021-05-29 07:17 +0000
      Re: Connecting to an SSH server from the external world "D. Stussy" <spam@spam.org> - 2021-05-29 20:34 -0700
        Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-05-30 12:51 +0200
          Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-31 22:48 -0600
            Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-01 18:42 +0200
              Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-01 14:46 -0600
                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-03 12:50 +0200
                  Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-03 22:53 -0600
                    Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-05 19:25 +0200
                      Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-05 16:38 -0600
                        Re: Connecting to an SSH server from the external world "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-06-05 18:58 -0400
                        Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-12 11:16 +0200
                          Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-12 11:12 -0600
                            Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-13 13:55 +0200
                              Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-13 10:40 -0600
                                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-14 16:29 +0200
                                  Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-14 11:32 -0600
                              Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-06-13 17:55 +0000
                                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-06-14 16:34 +0200
                                  Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-06-14 11:39 -0600
                                    Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-06-14 21:03 +0000
                                      Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-06-14 22:26 +0000
        Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-31 22:45 -0600
    Re: Connecting to an SSH server from the external world Richard Kettlewell <invalid@invalid.invalid> - 2021-05-29 08:55 +0100
    Re: Connecting to an SSH server from the external world Giovanni <lsodgf0@home.net.it> - 2021-05-29 11:01 +0200
      Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-29 18:44 +0200
        Re: Connecting to an SSH server from the external world Giovanni <lsodgf0@home.net.it> - 2021-05-29 19:14 +0200
          Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-29 18:21 +0000
            Re: Connecting to an SSH server from the external world Roger Blake <rogblake@iname.invalid> - 2021-05-29 21:28 +0000
              Re: Connecting to an SSH server from the external world Johann Beretta <beretta@nun-ya-bizness.com> - 2021-05-29 22:03 -0700
                Re: Connecting to an SSH server from the external world Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-05-30 13:02 +0200
                  Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 19:35 +0200
                    Re: Connecting to an SSH server from the external world Johann Beretta <beretta@nun-ya-bizness.com> - 2021-08-11 11:48 -0700
            Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:41 -0600
              Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-30 14:43 +0000
                Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-31 10:22 +0200
                  Re: Connecting to an SSH server from the external world William Unruh <unruh@invalid.ca> - 2021-05-31 17:29 +0000
            Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 12:12 +0200
          Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 12:11 +0200
        Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:48 -0600
          Re: Connecting to an SSH server from the external world Marc Haber <mh+usenetspam1118@zugschl.us> - 2021-05-30 12:13 +0200
    Re: Connecting to an SSH server from the external world "Carlos E.R." <robin_listas@es.invalid> - 2021-05-29 20:56 +0200
      Re: Connecting to an SSH server from the external world Grant Taylor <gtaylor@tnetconsulting.net> - 2021-05-29 19:44 -0600

Page 1 of 3  [1] 2 3  Next page →

#4882 — Connecting to an SSH server from the external world

	I have the following problem:

	I would like to be able to connect from my laptop to my SSH 
server in my internal network, no matter where the laptop may be. 
However, my SSH server accepts connections from specific IP addresses - 
those to do with work - and rejects all others. 

	The problem is that I will often try to connect from my laptop 
when it is using an Internet feed that is not the one at work. Is there 
anything I can do at the laptop so that when it tries to connect to my 
SSH server, the connection will be accepted? 

	The obvious solution would be to have an SSH server listening on 
a non-standard port, for this specific purpose. However, I would prefer 
to use a solution that requires no changes in my SSH server - only in the 
client in my laptop. Any ideas?

[toc] | [next] | [standalone]

#4885

On 2021-05-28, John Smith <12345@whatismyemailaddress.xyz> wrote:
> 	I have the following problem:
>
> 	I would like to be able to connect from my laptop to my SSH 
> server in my internal network, no matter where the laptop may be. 
> However, my SSH server accepts connections from specific IP addresses - 
> those to do with work - and rejects all others. 

Lets see, that ssh server (Is it really yours-- ie do you own it-- or is
it your company's) has security on it to only accept connections from
the company network and you want instead to connect from anywhere, which
means that anyone can connect from anywhere. 
 Remove the condition that ssh can only connect from work IP
addresses. Or would this be against company policy?

>
> 	The problem is that I will often try to connect from my laptop 
> when it is using an Internet feed that is not the one at work. Is there 
> anything I can do at the laptop so that when it tries to connect to my 
> SSH server, the connection will be accepted? 
>
> 	The obvious solution would be to have an SSH server listening on 
> a non-standard port, for this specific purpose. However, I would prefer 
> to use a solution that requires no changes in my SSH server - only in the 
> client in my laptop. Any ideas?
>

[toc] | [prev] | [next] | [standalone]

#4891

On Fri, 28 May 2021 22:28:22 +0000, William Unruh wrote:

> On 2021-05-28, John Smith <12345@whatismyemailaddress.xyz> wrote:
>> 	I have the following problem:
>>
>> 	I would like to be able to connect from my laptop to my SSH
>> server in my internal network, no matter where the laptop may be.
>> However, my SSH server accepts connections from specific IP addresses -
>> those to do with work - and rejects all others.
> 
> Lets see, that ssh server (Is it really yours-- ie do you own it-- or is
> it your company's) has security on it to only accept connections from
> the company network and you want instead to connect from anywhere, which
> means that anyone can connect from anywhere.
>  Remove the condition that ssh can only connect from work IP
> addresses. Or would this be against company policy?

	The server is my own - I can modify it as I wish.

	What I am asking is whether things could be arranged so that 
specific clients - as in running on specific hardware - could connect 
from anywhere, whereas any other clients cannot, unless they come from 
specific IP addresses. I guess that ome could use the client's MAC 
address, but I don't know how.


> 
> 
>> 	The problem is that I will often try to connect from my laptop
>> when it is using an Internet feed that is not the one at work. Is there
>> anything I can do at the laptop so that when it tries to connect to my
>> SSH server, the connection will be accepted?
>>
>> 	The obvious solution would be to have an SSH server listening on
>> a non-standard port, for this specific purpose. However, I would prefer
>> to use a solution that requires no changes in my SSH server - only in
>> the client in my laptop. Any ideas?
>>

[toc] | [prev] | [next] | [standalone]

#4892

Le 29/05/2021 à 16:38, John Smith a écrit :
> 
> I guess that ome could use the client's MAC address

No. A MAC address can be forged easily and is visible only on the same 
LAN, not across an internet.

[toc] | [prev] | [next] | [standalone]

#4894

On Sat, 29 May 2021 17:19:19 +0200, Pascal Hambourg wrote:

> Le 29/05/2021 à 16:38, John Smith a écrit :
>> 
>> I guess that ome could use the client's MAC address
> 
> No. A MAC address can be forged easily and is visible only on the same
> LAN, not across an internet.

	Yes, if that information is transferred in the clear then this 
approach would be a no-no. Thanks.

[toc] | [prev] | [next] | [standalone]

#4893

On 2021-05-29, John Smith <12345@whatismyemailaddress.xyz> wrote:
> On Fri, 28 May 2021 22:28:22 +0000, William Unruh wrote:
>
>> On 2021-05-28, John Smith <12345@whatismyemailaddress.xyz> wrote:
>>> 	I have the following problem:
>>>
>>> 	I would like to be able to connect from my laptop to my SSH
>>> server in my internal network, no matter where the laptop may be.
>>> However, my SSH server accepts connections from specific IP addresses -
>>> those to do with work - and rejects all others.
>> 
>> Lets see, that ssh server (Is it really yours-- ie do you own it-- or is
>> it your company's) has security on it to only accept connections from
>> the company network and you want instead to connect from anywhere, which
>> means that anyone can connect from anywhere.
>>  Remove the condition that ssh can only connect from work IP
>> addresses. Or would this be against company policy?
>
> 	The server is my own - I can modify it as I wish.
>
> 	What I am asking is whether things could be arranged so that 
> specific clients - as in running on specific hardware - could connect 
> from anywhere, whereas any other clients cannot, unless they come from 
> specific IP addresses. I guess that ome could use the client's MAC 
> address, but I don't know how.

None of that information is transmitted in trying to set up the
connection. It would be insecue to do so, handing out far too much
information to the whole world. As has been mentioned you could try port
knocking-- still not terribly secure but it depends on the level of
aversary you are protecting from. You could also just change your ssh
port number since most ssh attacks use the standard ssh ports.
.
>
>
>> 
>> 
>>> 	The problem is that I will often try to connect from my laptop
>>> when it is using an Internet feed that is not the one at work. Is there
>>> anything I can do at the laptop so that when it tries to connect to my
>>> SSH server, the connection will be accepted?
>>>
>>> 	The obvious solution would be to have an SSH server listening on
>>> a non-standard port, for this specific purpose. However, I would prefer
>>> to use a solution that requires no changes in my SSH server - only in
>>> the client in my laptop. Any ideas?
>>>
>

[toc] | [prev] | [next] | [standalone]

#4904

On 5/29/21 9:27 AM, William Unruh wrote:
> As has been mentioned you could try port knocking-- still not terribly 
> secure but it depends on the level of aversary you are protecting from.

Dynamic port knocking or Single Packet Authentication uses cryptographic 
primitives to make each knock different.  As in the source IP and / or 
time of day is taken into consideration for the port(s) and / or 
sequence to be knocked on.

Much like port knocking eliminates a lot of chaff, dynamic port knocking 
or SPA eliminates the simple playback of previous port knocks.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4916

John Smith <12345@whatismyemailaddress.xyz> writes:
> On Fri, 28 May 2021 22:28:22 +0000, William Unruh wrote:
>> On 2021-05-28, John Smith <12345@whatismyemailaddress.xyz> wrote:
>>> 	I have the following problem:
>>>
>>> 	I would like to be able to connect from my laptop to my SSH
>>> server in my internal network, no matter where the laptop may be.
>>> However, my SSH server accepts connections from specific IP addresses -
>>> those to do with work - and rejects all others.
>> 
>> Lets see, that ssh server (Is it really yours-- ie do you own it-- or is
>> it your company's) has security on it to only accept connections from
>> the company network and you want instead to connect from anywhere, which
>> means that anyone can connect from anywhere.
>>  Remove the condition that ssh can only connect from work IP
>> addresses. Or would this be against company policy?
>
> 	The server is my own - I can modify it as I wish.

So remove the restriction that you find inconvenient. You are currently
locking your own door and then asking how to open it.

> 	What I am asking is whether things could be arranged so that 
> specific clients - as in running on specific hardware - could connect 
> from anywhere, whereas any other clients cannot, unless they come from 
> specific IP addresses. I guess that ome could use the client's MAC 
> address, but I don't know how.

SSH authenticates by key or password. Keys seem like a good fit for you
here.

-- 
https://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#4917

On Sat, 29 May 2021 14:38:16 +0000 (UTC), John Smith
<12345@whatismyemailaddress.xyz> wrote:

> On Fri, 28 May 2021 22:28:22 +0000, William Unruh wrote:
> 
> > On 2021-05-28, John Smith <12345@whatismyemailaddress.xyz> wrote:
> >> 	I have the following problem:
> >>
> >> 	I would like to be able to connect from my laptop to my SSH
> >> server in my internal network, no matter where the laptop may be.
> >> However, my SSH server accepts connections from specific IP addresses -
> >> those to do with work - and rejects all others.
> > 
> > Lets see, that ssh server (Is it really yours-- ie do you own it-- or is
> > it your company's) has security on it to only accept connections from
> > the company network and you want instead to connect from anywhere, which
> > means that anyone can connect from anywhere.
> >  Remove the condition that ssh can only connect from work IP
> > addresses. Or would this be against company policy?
> 
> 	The server is my own - I can modify it as I wish.
> 
> 	What I am asking is whether things could be arranged so that 
> specific clients - as in running on specific hardware - could connect 
> from anywhere, whereas any other clients cannot, unless they come from 
> specific IP addresses.

If you can accept the connecting username as identifier (admittedly a weak
security model difficult to enforce and easy to bypass; you can make it
slightly better if you use pubkey authentication only and users are not
allowed to copy other users' keys), then you can use openssh server's
"Match" directives in sshd_config to filter based on that and/or source IP
address and deny or permit access accordingly.

Eg (adapt as needed):

PasswordAuthentication no
PubKeyAuthentication no

# allow user bob and alice only from host 1.2.3.4
Match User alice,bob Address 1.2.3.4
  PasswordAuthentication yes   # or whatever
  PubKeyAuthentication yes


# allow user charlie from anywhere
Match User charlie Address *
  PasswordAuthentication yes
  PubKeyAuthentication yes


Or directly use the AllowUsers option:

AllowUsers bob@1.2.3.4 alice@1.2.3.4 charlie@*

(Going by memory here, the syntax for all the above might not be 100%
correct, but those options do definitely exist.)

As mentioned, this is a very low-security solution, but depending on your
specific environment and use case it might be enough for your needs.

[toc] | [prev] | [next] | [standalone]

#4886

On 5/28/21 3:31 PM, John Smith wrote:
> I would like to be able to connect from my laptop to my SSH server 
> in my internal network, no matter where the laptop may be.  However, 
> my SSH server accepts connections from specific IP addresses - those 
> to do with work - and rejects all others.

I can't tell if the enforcement / filtering of specific IP addresses is 
done on the SSH server and / or something between the SSH server and the 
Internet.

Is the SSH server running on the router or something downstream / inside 
of the router?

> The problem is that I will often try to connect from my laptop when 
> it is using an Internet feed that is not the one at work. Is there 
> anything I can do at the laptop so that when it tries to connect to 
> my SSH server, the connection will be accepted?

You're asking if there is something that a client can do to defeat the 
security that a server has in place.  I would certainly hop not.

That being said, you can probably make some minor modifications to your 
server and your client to allow them to talk.

You can probably also ssh from your client to a work system and then ssh 
from there to your home system so that your home system sees your work 
IP and allows the connection with the existing filtering / enforcement.

> The obvious solution would be to have an SSH server listening on 
> a non-standard port, for this specific purpose.

Obscurity is not security in and of itself.  Many things will find SSH 
servers on alternate ports on the Internet.

> However, I would prefer to use a solution that requires no changes 
> in my SSH server - only in the client in my laptop. Any ideas?

You really want something that requires you make a change, likely small, 
to the ssh server and / or router connecting it to the Internet.  Then 
you make a similar change to your client to dock with the ssh server.

Port knocking and VPNs come to mind.

One thing that comes to mind is making your ssh server available via a 
Tor hidden service (with strict security requirements.  Tor has the 
advantage of being able to reach out to systems on the Internet and 
rondevu without needing to poke holes in firewalls.

I'm sure that there are other VPNs that can do similar.  I'm just not 
familiar with them.

You can also make changes your ssh server / router that it's behind to 
enable the client to connect and communicate with some form of 
authentication.  This is also frequently the realm of VPN / port 
knocking / single packet authorization.

But you *REALLY* want to have to do /something/ on the SSH server / 
router to say that clients with a very specific behavior are allowed in. 
  If clients could make a change and bypass your security without the 
SSH server / router blessing it ... that would be a security fail.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4890

On Fri, 28 May 2021 16:36:03 -0600, Grant Taylor wrote:

> On 5/28/21 3:31 PM, John Smith wrote:
>> I would like to be able to connect from my laptop to my SSH server in
>> my internal network, no matter where the laptop may be.  However,
>> my SSH server accepts connections from specific IP addresses - those to
>> do with work - and rejects all others.
> 
> I can't tell if the enforcement / filtering of specific IP addresses is
> done on the SSH server and / or something between the SSH server and the
> Internet.
> 
> Is the SSH server running on the router or something downstream / inside
> of the router?

	Downstream. The router just forwards connections on port 22 to 
the appropriate system in my network.


>> The problem is that I will often try to connect from my laptop when it
>> is using an Internet feed that is not the one at work. Is there
>> anything I can do at the laptop so that when it tries to connect to my
>> SSH server, the connection will be accepted?
> 
> You're asking if there is something that a client can do to defeat the
> security that a server has in place.  I would certainly hop not.

	What I am asking is whether the server could allow connections in 
selectively on the basis of some piece of information unique to hardware 
that the client is running on - like e.g. its MAC address.
 

[toc] | [prev] | [next] | [standalone]

#4897

John Smith <12345@whatismyemailaddress.xyz> wrote:
>What I am asking is whether the server could allow connections in 
>selectively on the basis of some piece of information unique to hardware 
>that the client is running on - like e.g. its MAC address.

Without tinkering, and at your level of knowlegde, no. Those people
who would be able to do that would probably need to modify the server,
and would probably refrain from building such a construction for good
reasons.

Greetings
Marc
-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber         |   " Questions are the         | Mailadresse im Header
Mannheim, Germany  |     Beginning of Wisdom "     | 
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834

[toc] | [prev] | [next] | [standalone]

#4906

On 5/29/21 8:42 AM, John Smith wrote:
> Downstream. The router just forwards connections on port 22 to the 
> appropriate system in my network.

Is the router forwarding /all/ connections to the system in your 
network?  Or is it only forwarding /some/ /specific/ source IPs?

If it is, or could be made to be, forwarding /all/ connections, then you 
can have filtering logic on the system in your network.

> What I am asking is whether the server could allow connections in 
> selectively on the basis of some piece of information unique to 
> hardware that the client is running on - like e.g. its MAC address.

MAC addresses as they are normally used don't traverse routers.

I would strongly advocate for SSH keys.  Or better would be SSH 
certificates.  The client must present a client certificate to the SSH 
server that the SSH server trusts.  (This is in addition to normal 
account requirements like ~/.ssh/known_hosts.)  Though these rely on the 
security of the SSH server and it needs to be exposed to the Internet to 
allow incoming connections from anywhere.

I would suggest a VPN of some sort; IPsec, OpenVPN, or WireGuard, 
between clients and your router.  Your router could be configured to 
allow SSH traffic from VPN(s) in to the server on your network while 
blocking SSH traffic that didn't come through a VPN.  This has the 
advantage of only needing to expose the SSH server to clients that have 
valid VPN connections, meaning people you likely trust.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4887

On 2021-05-28, John Smith <12345@whatismyemailaddress.xyz> wrote:

Hi John (Yeah! "John" is certainly your name. Isn't it?).

> 	I have the following problem:

Ever heard about port knock client and server?

You would have to install a knockd on you server and use a knock client
on your laptop. This way you explicitly open your firewall for a short
period to establish a connection and then close it again.

Best regards.
-- 
Can't open /usr/fortunes.  Lid stuck on cookie jar.

[toc] | [prev] | [next] | [standalone]

#4908

One doesn't need to run a program to do port knocking if one has a stateful firewall.  For Linux and similar unices, iptables with a 
recent list (using a timeout) can be configured to work.

Note also that port knocking, although defined in terms of UDP, need not use UDP ports.  One can use other IP protocols, and in some 
circumstances, even some port-less protocols might work.

"Henning Hucke"  wrote in message news:slrnsb3ql0.9a0.h_hucke+spam.news@romulus.aeon.icebear.cloud...
On 2021-05-28, John Smith <12345@whatismyemailaddress.xyz> wrote:
Hi John (Yeah! "John" is certainly your name. Isn't it?).

> I have the following problem:

Ever heard about port knock client and server?

You would have to install a knockd on you server and use a knock client
on your laptop. This way you explicitly open your firewall for a short
period to establish a connection and then close it again.

Best regards. 

[toc] | [prev] | [next] | [standalone]

#4914

Le 30/05/2021 à 05:34, D. Stussy a écrit :
> One doesn't need to run a program to do port knocking if one has a 
> stateful firewall.  For Linux and similar unices, iptables with a recent 
> list (using a timeout) can be configured to work.

This only allows basic port knocking which is vulnerable to replay and 
brute force attacks.
And it still requires a program on the client side to send the packets.

[toc] | [prev] | [next] | [standalone]

#4924

On 5/30/21 4:51 AM, Pascal Hambourg wrote:
> This only allows basic port knocking which is vulnerable to replay and 
> brute force attacks.

Yes in a basic sense.

No in that it's possible, all be it complicated, to code things such 
that different knocks are needed from different IPs.

Technically, it can be replayed for the same IP.  But it can't be 
replayed for different IPs.

There's also the fact that the IPTables rule set could be periodically 
changed thus thwarting replay for even the same IP.

> And it still requires a program on the client side to send the packets.

Depending on what protocol and port is used, it may be possible to use a 
web browser or telnet or ping.

Does using Bash's built in ability to send TCP & UDP packets count as a 
program in the manner you are describing?

}:-)



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4926

Le 01/06/2021 à 06:48, Grant Taylor a écrit :
> On 5/30/21 4:51 AM, Pascal Hambourg wrote:
>> This only allows basic port knocking which is vulnerable to replay and 
>> brute force attacks.
> 
> Yes in a basic sense.
> 
> No in that it's possible, all be it complicated, to code things such 
> that different knocks are needed from different IPs.

How do you do this with iptables for any IP address ?
I am not asking for the complete solution, only the basic principle.

>> And it still requires a program on the client side to send the packets.
> 
> Depending on what protocol and port is used, it may be possible to use a 
> web browser or telnet or ping.
> 
> Does using Bash's built in ability to send TCP & UDP packets count as a 
> program in the manner you are describing?

No more than the other programs you mentioned. It may be used by a port 
knocking client script, but none is a port knocking program by itself.

[toc] | [prev] | [next] | [standalone]

#4927

On 6/1/21 10:42 AM, Pascal Hambourg wrote:
> How do you do this with iptables for any IP address ?
> I am not asking for the complete solution, only the basic principle.

In short, you add additional rule sets for different source IPs.

You obviously don't want to explode the multiple rules for each set by 
the number of IPs that are out there.

But, I could see how someone might duplicate the multiple rules for 
different networks / ASNs.

Note:  I'm speaking to a technical possibility, not the practicality of 
doing something.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4928

Le 01/06/2021 à 22:46, Grant Taylor a écrit :
> On 6/1/21 10:42 AM, Pascal Hambourg wrote:
>> How do you do this with iptables for any IP address ?
>> I am not asking for the complete solution, only the basic principle.
> 
> In short, you add additional rule sets for different source IPs.
> 
> You obviously don't want to explode the multiple rules for each set by 
> the number of IPs that are out there.
> 
> But, I could see how someone might duplicate the multiple rules for 
> different networks / ASNs.

IIUC it is not applicable to connect from any random IP address, only 
from specific IP addresses or networks known in advance.

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | comp.os.linux.networking

csiph-web