Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Port knocking is a network security measure to hide tcp/udp ports of services by requiring the user to "knock" on other arbitrarily configured ports first. The port sequence knocking to reveal the main port could also require a time between knocks.

2
votes
5answers
471 views

What are the best pratices to avoid my server being port scanned

The title probably says it all. I just wanna know what are the best technics to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).
2
votes
1answer
178 views

Iptables DROPS SSH after port knock rules, but nmap shows it as OPEN

I setup port knocking rules on CentOS 7, iptables as follow: -I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7 -I ...
2
votes
3answers
84 views

there is any port opening script or solution to increase security? I mean port is opened just when some port sequence detected on log

In order to increase security, for example on ssh remote connections, I: open a non stardard port. use mandatory digital certificates for authentication. allow connection from a ip range only. But I ...
1
vote
1answer
356 views

Setting up Knockd issues

So i'm busy setting up a knockd service on a VM to enable SSH login when the correct sequence of ports are "knocked on" using knockd and ufw. The issue that I am currently having is that when the ...
-1
votes
1answer
474 views

Does port knocking increase security behind a router?

Port knocking is an additional layer of security that can be added to an already existing security concept for a server. The web server runs the SSH service behind a port, e.g. the default port 22, ...
27
votes
1answer
4k views

Why is it better to use ports 20 and 53 as source ports when portscanning?

I read that if a server is inside a DMZ behind a stateless firewall, it is a good idea to use ports 20 and 53 as source ports when conducting port scanning. Why is this a good idea? I guess the ...
0
votes
2answers
224 views

Wondering about open port found while using VPN service

I have noticed during port scanning that my "anonymous" IP has an open port (111) while I am using VPN. Does this make me vulnerable as user or is it the provider's failure? Should I change ...
1
vote
0answers
37 views

Port Knocking origination matching problem

I set up port knocking using first this method using knockd and then I tried using this method using only iptables directly but when both failed I thought I'd check a bit deeper into the problem. ...
104
votes
17answers
24k views

Is “password knocking” a good idea?

With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running. How about password knocking? For example you have three passwords: A, B and C. ...
1
vote
1answer
1k views

portscan using nmap fails to return open dhcp-port

I've just stumbled upon something pretty weird, at least for me at this moment. When i've finished setting up my openBSD 5.5 server, along with the isc-dhcp43-server port. I tried to see if i could ...
3
votes
1answer
4k views

Is there any practical attack on port knocking method?

I was wondering, how can I bypass the port knocking method. Is there any public vulnerability or method for attacking port knocking services? For example: I know an SSH port is behind a port ...
3
votes
2answers
414 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
4
votes
2answers
301 views

How common is port-knocking? [closed]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
2
votes
2answers
4k views

Practical ways to prevent Denial Of Service attacks

I am an undergraduate Computer Science student and was hoping to gain some knowledge of ways to help prevent Denial Of Service attacks.I read about some of here: https://en.wikipedia.org/wiki/...
2
votes
3answers
540 views

Simple explanation of Port Knocking

I was just referring to this article: http://en.wikipedia.org/wiki/Port_knocking The term Port Knocking, as explained here, was slightly confusing and I was feeling difficulty in getting the hang of ...
2
votes
2answers
353 views

Two-factor port-knocking via SMS (TXT)

It seems to me that a useful alternative or supplement to traditional port-knocking, fwknop, etc, for a system requiring only occasional access, would be to: Set up a one-time pad of keys, and a pre-...
2
votes
2answers
477 views

Hide logging server from DMZ

I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers. In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...
4
votes
1answer
108 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
1
vote
1answer
438 views

Steganography using all TCP/UDP ports?

I just had an idea, and usually when I come up with one, it turns out it was already invented, so... Is there some standard that would consist of multiple parties sniffing on all of their TCP/UDP ...
3
votes
1answer
3k views

How does knockd work?

It's rather easy to configure knockd for ex.: on an Ubuntu server's (10.04) sshd: ======================================================================== 0) # install knockd on the SERVER side apt-...
1
vote
3answers
1k views

Bibliography of attacks by port scanning techniques

I have to present a paper and make a presentation about the principal types of attacks by port scanning. What literature do you recommend to cover enough information about: types of attacks, port ...
5
votes
4answers
235 views

software to keep a list of IP that try to access ssh over a set of rules and feasibility

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like: one attempt to log as ...
35
votes
7answers
12k views

Port Knocking is it a good idea?

Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...