"The first time I have seen the knockd project I liked it instantly. The idea is so simple, and though so effective. Knockd is a port-knocking application that silently runs on a server passively listening to network traffic. Once it will see a port sequence it has an action configured for it, it will run that action. We can see this as a remote control to our server: once we hit the right button it will take the appropriate action!"
Post a Comment
Member since:
2005-11-11
Member since:2005-07-06
Agreed.
Here is a brief writeup of doing this just in iptables:
http://www.debian-administration.org/articles/268
Member since:
2005-08-17
Member since:2005-11-11
The reason I started using it a while ago was for precisely that, reducing the size of the log files relating to the services I was running. Smaller log files are easier to read and spot trouble.
Problems can occour, however, when you have a large number of people trying to make use of the services hidden behind port knocking. Larger sequences are more secure, but longer sequences are also harder to remember, which means that shorter sequences tend to be prefered.
I think it's great for personal use or use by a small number of people, but not much more than that.
Member since:
2005-07-06
Member since:
2005-08-18
Member since:2005-10-05
I completely agree. I used to get all sorts of login attempts when I had SSH running on the standard port. So I moved it to a non-standard port (one well above 1024) and absolutely nobody tries to log in now. The ports scanners usually don't find it because they usually only try common ports.
Port knocking is a cool idea though, and it's just one more layer that can deter a non-motivated wannabe intruder.
Member since:2005-07-06
I used to get all sorts of login attempts when I had SSH running on the standard port. So I moved it to a non-standard port (one well above 1024) and absolutely nobody tries to log in now.
So did I. Of course, you can't use it as a security measure because you must secure SSH properly as you would normally do, but what it does do is stop pointless log in attempts from automated attacks on port 22 and stop your logs filling up with them.
Member since:
2006-06-03
Member since:
2006-03-05
