0

I found an implementation of port knocking described in an article: https://www.digitalocean.com/community/tutorials/how-to-configure-port-knocking-using-only-iptables-on-an-ubuntu-vps

I checked what iptables DROP actually means and now I am very confused: https://serverfault.com/questions/157375/reject-vs-drop-when-using-iptables

When using DROP rules: - UDP packets will be dropped and the behavior will be the same as connecting to an unfirewalled port with no service. - TCP packets will return an ACK/RST which is the same response that an open port with no service on it will respond with. Some routers will respond with and ACK/RST on behalf of servers which are down.

In my book this means that the response for DROP will be different than for a closed port. And if they can be distinguished from each other, then the members of the knocking sequence can be found. If somebody knows the members of the sequence, then it takes several magnitude less trials to crack this kind of defense, which means it can be brute forced very easily.

Am I right that this implementation of port knocking is vulnerable?

Improve this question
5
  • 2
    I suggest you read the comments on the linked answer, as it is contested. I also do not agree with the answer. Also the behavior could be verified with a packet capture.
    – multithr3at3d
    Commented May 4, 2020 at 14:52
  • Port knocking was an interesting novelty back in the day, today not so much. It's a fun exercise but you should carefully evaluate any use case as port knocking is almost certainly a bad way to go.
    – user10216038
    Commented May 4, 2020 at 15:07
  • @user10216038 Idk why an additional layer of security can be bad. Does it compromise something else?
    – inf3rno
    Commented May 4, 2020 at 15:18
  • Yes! as @multithr3at3d pointed out, the port knocking is readily apparent in the packet traffic. What's more, it's a virtual flare of, "Hey look at me, I'm doing something unusual!"
    – user10216038
    Commented May 4, 2020 at 15:22
  • If you're using port knocking on top of some actual authentication method, then the entire scheme might be safe (if a little obvious to anybody looking, but obscurity is not real security anyhow). However, almost all of that security would be in the actual authentication method. Port knocking alone provides very little security under realistic conditions, and is rather pointless when there are easy ways to send much more secure authentication credentials.
    – CBHacking
    Commented Sep 26, 2021 at 22:48

1 Answer 1

Reset to default
1

As a matter of fact, there is no response in DROP. But yes, it is different as the OS will send back an icmp reply for a closed port indeed.

About the safety of the code, it simply drops all other ports as well, so it seems safe enough:

sudo iptables -A GATE1 -j DROP
Improve this answer
2
  • Okay, but what happens when I run iptables on a server and I forward only the ports from the router which I use in the knocking sequence? Isn't it possible in that case that the router sends a different response for a port scanning as the DROP on the server? Well I guess your answer responded that.
    – inf3rno
    Commented May 4, 2020 at 15:20
  • if the rule is DROP, it always drops the packets with no replies sent back to the sender. REJECT on the other hand, drops the packet and send his condolences to the sender using icmp :)
    – MTG
    Commented May 4, 2020 at 15:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .