0

The Goal Create a secure process to open a firewall port on a server (on demand), start a listening server, and ultimately close the firewall port. This would improve security by not always having a port open for DoS and port scans. With key usage I could restrict/control access to a few select parties.

The Implementation Most servers run an ssh daemon (sshd) for administrative access. sshd would be configured to run on non standard port and authenticate with pub/priv keys. A (root) user account would be configured with a login script that would open port and close it after a defined period. The script would also start the listening server if it was not already started.

Assumptions and Knowns The listening server would authenticate and be security aware. DoS and scan vulnerable when listen server running. The hard time out would only affect future connections and not close secure open connections.

  • If you're going to the trouble of using SSH, why not just use port forwarding over SSH and never expose the service at all? – multithr3at3d Apr 24 '18 at 21:36
  • The server could be TCP or UDP. Established connections (https websockets). I would possibly expose the server implementation upon connection. – sfanjoy Apr 24 '18 at 21:43
  • SOCKS5, if you do SSH dynamic port forwarding, is able to handle both TCP and UDP, but you are probably right that it wouldn't be convenient here. – multithr3at3d Apr 24 '18 at 21:46
  • I'll read up on SOCKS5. I did something similar with xinetd but the hacking gremlins would eat up my connection limit. Usage is infrequent but important to be reliable. – sfanjoy Apr 24 '18 at 21:51
  • See port knocking and the variant where packets to open up the port contains GPG signed data. – Patrick Mevzek Apr 24 '18 at 22:51
2

Create a secure process to open a firewall port on a server (on demand) start a listening server, and ultimately close the firewall port.

Your goal seems flawed for many reasons. This would not be scalable in an enterprise environment due to the lack of available ports that could blossom on a heavy day of visits/work. You would always have to have multiple firewalls in round-robin behind load balancing. Further, your firewall would need all types of ASICs to make it work making it a pretty expensive firewall. On the DoS side of the equation, you're wrong. Sending 10gbps to any socket opened or not will kill a 1gb connection regardless of how many drops/rejects (which are not a good idea), that you envision making. The BETTER logic would be to configure your router to only accept connections from trusted sources, and block all of the remainder.

I won't even get into the statistics of client side exploits, phishing, and other attacks your firewall won't stop. But at the onset, your goal doesn't do much but add a lot of overhead and complexities that will likely hinder you in the future.

Your implementation is also flawed and based on security through obscurity (changing the firewall port). You would be better off using standard port with rules in place on that port with two factor authentication. You're assuming an attacker won't find the port. While you may minimize the low hanging fruit, eventually someone will find the port, and although they may not be able to do anything, the can certainly perform a resource exhaustion (DoS) against your firewall. That in turn depending on its placement could outright block all traffic. "Root" access is a horrible idea especially at the egress point, and you're assuming a firewall of this nature would be run perhaps Linux? While it may be, most ASIC based firewalls that need to do heavy hauling tend to consist of JeOS (Just Enough Operating System. But should you insist to go the Linux route, this is what sudo is for.

I didn't bother with assumptions, there is no need to.

  • In different words, My goal is to have minimal to almost no attack surface on the server. I shouldn't put implementation detail in the Goal as to have it flawed. Since ssh has to be in the attack vector I was trying to use it to add a service to the vector and then remove it. My (root) account would be a user space acct allowed to run only one command (sudo <cmd>). So opening a port with no server binding on that port would have an attack surface size very close to only running sshd? – sfanjoy Apr 26 '18 at 17:40
0

Yes, it could improve security somewhat. Depending on how often/long would the ports be open, it could help a lot against opportunistic or non-determined attackers. A determined targeted attacker would probably figure it out eventually and wait for the ports to be opened.

I would still recommend SSH tunneling if feasible, as was mentioned in comments. Tunneling would completely negate any chance of attacker getting inside the machine using the services protected this way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.