个人工具
登录
查看“UbuntuHelp:PortKnocking”的源代码 - Ubuntu中文
UbuntuHelp
讨论
查看源代码
历史
搜索
导航
首页
最近更改
随机页面
页面分类
帮助
编辑
编辑指南
沙盒
新闻动态
字词处理
工具
链入页面
相关更改
特殊页面
页面信息
查看“UbuntuHelp:PortKnocking”的源代码
来自Ubuntu中文
←
UbuntuHelp:PortKnocking
跳转至:
导航
,
搜索
因为以下原因,你没有权限编辑本页:
您所请求的操作仅限于该用户组的用户使用:
用户
您可以查看与复制此页面的源代码。
{{From|https://help.ubuntu.com/community/PortKnocking}} {{Languages|UbuntuHelp:PortKnocking}} == What is Port Knocking ? == Port knocking is a simple and great method to grant remote access without leaving a port constantly open. This preserves your server from port scanning and script kiddie attacks. To utilize port knocking, the server must have a firewall and run the knock-daemon. As the name lets us imaginate, the daemon is listening for a specific sequence of TCP or UDP "knocks". If the sequence is played correctly then a command is executed, typically, the port of the application is opened for the source IP address through the firewall. This method is perfectly secure, as port knocking is located at a very low level in the TCP/IP stack and does not require any opened ports. The knock-daemon is also invisible to attackers. On the client side, the only thing you have to do is to play the sequence. You can do that whith the client that you prefer, a client program also exists called '''knock'''. == Server Setup == The setup of the server is quite easy. First, you have to ensure that your server has a running firewall. Then, install the following packages: <code><nowiki>knockd</nowiki></code> (see InstallingSoftware). Then, edit the configuration file. We will present two different approches. One that is more adapted to connections with no keep-alive (http for example !), another mode adapted to permenant connections (SSH, IRC...). As you will notice, the syntax of the configuration file is quite easy to understand. == Example 1 == Here is the default configuration file for the knock daemon (<code><nowiki>/etc/knockd.conf</nowiki></code>) : <pre><nowiki> [options] logfile = /var/log/knockd.log [openSSH] sequence = 7000,8000,9000 seq_timeout = 5 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 80 -j ACCEPT tcpflags = syn [closeSSH] sequence = 9000,8000,7000 seq_timeout = 5 command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 80 -j ACCEPT tcpflags = syn </nowiki></pre> Here we have defined two sequences : ** '''openSSH''' that opens the http port if the 7000,8000 and 9000 ports are knocked ** '''closeSSH''' that close the http port if the 9000,8000 and 7000 ports are knocked == Example 2 == The second example file is a bit different from the orginal : <pre><nowiki> options] logfile = /var/log/knockd.log [SSH] sequence = 7000,8000,9000 seq_timeout = 5 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn cmd_timeout = 10 stop_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT </nowiki></pre> In the default configuration file, you have two sequences : ** one for opening the port ** a second one for closing the port We advocate for opening the port fort a short time range (in the example 10s). For this example to be functionnal, you have to have a statefull firewall running on your server (which means you have to accept connections with <code><nowiki>-m state --state RELATED,ESTABLISHED</nowiki></code>). Let's explain this configuration file. If a user "knocks" ports 7000, 8000 and 9000 (in '''that''' order), the command will be played (opening port 22). Ten secondes later, the <code><nowiki>stop_command</nowiki></code> will be executed, closing the port. Do not forget to change the sequence (this is the example provided by the default installation), and... to provide the sequence to your users. Change the default configuration <code><nowiki>/etc/default/knockd</nowiki></code> in order that the knock-daemon is lanched : <pre><nowiki> # # knockd's default file, for generic sys config # # control if we start knockd at init or not # 1 = start # anything else = don't start START_KNOCKD=1 # command line options #KNOCKD_OPTS="-i eth0" </nowiki></pre> Now, just launch the daemon : <pre><nowiki> sudo /etc/init.d/knockd start </nowiki></pre> That's it ! == Client Side == On the client side, you can "knock" with whatever client you want : <code><nowiki>telnet</nowiki></code>, <code><nowiki>nc</nowiki></code> or even the software used to connect to the server (for example <code><nowiki>ssh</nowiki></code>). But, for more simplicity, you also have the knock client. Install the following packages: <code><nowiki>knockd</nowiki></code> (see InstallingSoftware). For knocking, just lanch the command ! <pre><nowiki> knock ''hostname'' ''port1'' ''port2'' ''port3'' </nowiki></pre> Then connect to your application. == Conclusion == You have done it ! Easy to setup, but very efficient, isn't it ? == Notice == Simple portknocking daemons as knockd are vulnerable because a sniffer may recover which ports where knocked. A better solution is Cryptknock (http://cryptknock.sourceforge.net/) Cryptknock's description says: "Cryptknock is an encrypted port knocking tool. Unlike other port knockers which use TCP ports or other protocol information to signal the knock, an encrypted string is used as the knock. This makes it extremely difficult for an evesdropper to recover your knock (unlike other port knockers where tcpdump can be used to discover a port knock)." == Links == [http://portknocking.org The orginal project] Detailed explanations on how it works and a reference implementation. [http://www.zeroflux.org/knock The port knocking daemon] The Ubuntu package is build from this release. A Win32 package is also available. You will also find other examples and some documentation. ---- [[category:CategoryNetworking]] [[category:CategoryDocumentation]] [[category:UbuntuHelp]]
该页面使用的模板:
模板:From
(
查看源代码
)
模板:Languages
(
查看源代码
)(受保护)
模板:Languages/Lang
(
查看源代码
)(受保护)
返回至
UbuntuHelp:PortKnocking
。