个人工具
登录
查看“UbuntuHelp:PortKnocking”的源代码 - Ubuntu中文
UbuntuHelp
讨论
查看源代码
历史
搜索
导航
首页
最近更改
随机页面
页面分类
帮助
编辑
编辑指南
沙盒
新闻动态
字词处理
工具
链入页面
相关更改
特殊页面
页面信息
查看“UbuntuHelp:PortKnocking”的源代码
来自Ubuntu中文
←
UbuntuHelp:PortKnocking
跳转至:
导航
,
搜索
因为以下原因,你没有权限编辑本页:
您所请求的操作仅限于该用户组的用户使用:
用户
您可以查看与复制此页面的源代码。
{{From|https://help.ubuntu.com/community/PortKnocking}} {{Languages|UbuntuHelp:PortKnocking}} #title Port Knocking == What is Port Knocking ? == Port knocking is a simple method to grant remote access without leaving a port constantly open. This preserves your server from port scanning and script kiddie attacks. To utilize port knocking, the server must have a firewall and run the knock-daemon. As the name conveys, the daemon is listening for a specific sequence of TCP or UDP "knocks". If the sequence is given correctly, then a command is executed; typically the source IP address is given access through the firewall to the port of an application (such as SSH). This method is reasonably secure, as port knocking is located at a very low level in the TCP/IP stack and does not require any opened ports. The knock-daemon is also invisible to potential attackers. On the client side, the only thing needed is to play the sequence with the client of your choice (such as '''knock'''). == Server Setup == The setup of the server is straightforward. First, ensure that your server has a running firewall. Then, install the <code><nowiki>knockd</nowiki></code> package (see [[UbuntuHelp:InstallingSoftware|InstallingSoftware]]). After the package is installed, edit its configuration file. Three approaches are presented below: the first is intended for connections with no keep-alive (such as HTTP), while the other two are intended for permanent connections (such as SSH and IRC). == Example 1 == <pre><nowiki> [options] logfile = /var/log/knockd.log [openHTTP] sequence = 7000,8000,9000 seq_timeout = 5 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 80 -j ACCEPT tcpflags = syn [closeHTTP] sequence = 9000,8000,7000 seq_timeout = 5 command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 80 -j ACCEPT tcpflags = syn </nowiki></pre> Here we have defined two sequences : * '''openHTTP''' opens the HTTP port if the 7000, 8000 and 9000 port sequence is "knocked" * '''closeHTTP''' closes the HTTP port if the 9000, 8000 and 7000 port sequence is "knocked" == Example 2 == The second example is a bit different from the original: <pre><nowiki> [options] logfile = /var/log/knockd.log [SSH] sequence = 7000,8000,9000 seq_timeout = 5 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn cmd_timeout = 10 stop_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT </nowiki></pre> == Example 3 == This example uses UFW commands instead of iptables: <pre><nowiki> [options] logfile = /var/log/knockd.log [SSH] sequence = 7000,8000,9000 seq_timeout = 5 start_command = ufw allow from %IP% to any port 22 tcpflags = syn cmd_timeout = 10 stop_command = ufw delete allow from %IP% to any port 22 </nowiki></pre> It's recommended to open the port for a short time (ten seconds, in the examples above). For this to be functional, you must have a state-full firewall running on your server (if using iptables, there must be a rule to accept connections with <code><nowiki>-m conntrack --ctstate RELATED,ESTABLISHED</nowiki></code>). Let's explain this configuration file. If a user "knocks" on ports 7000, 8000 and 9000 (in order), the command will be played (opening port 22). Ten seconds later, the <code><nowiki>stop_command</nowiki></code> will be executed, closing the port to new connections. Do not forget to change the sequence (this is the example provided by the default installation) and, of course provide the sequence to your users. You must also change the default configuration file <code><nowiki>/etc/default/knockd</nowiki></code> for the knockd daemon to start. Uncomment the START_KNOCKD=1 line to enable the daemon. If you have multiple network adapters or experience issues with knockd not starting automatically during system startup, you can manually specify the network interface to listen on by uncommenting and amending the second line KNOCKD_OPTS as well: <pre><nowiki> # # knockd's default file, for generic sys config # # control if we start knockd at init or not # 1 = start # anything else = don't start START_KNOCKD=1 # command line options KNOCKD_OPTS="-i eth0" </nowiki></pre> That's it! == Client Side == On the client side, you can "knock" with the client of your choice: <code><nowiki>telnet</nowiki></code>, <code><nowiki>nc</nowiki></code> or even the software used to connect to the server (for example <code><nowiki>ssh</nowiki></code>). If you do not use a client designed for portknocking, you must do the knock sequence manually. An easier method is to use the knock client. Install the <code><nowiki>knockd</nowiki></code> package (see [[UbuntuHelp:InstallingSoftware|InstallingSoftware]]). For knocking, launch the command: <pre><nowiki> knock ''hostname'' ''port1'' ''port2'' ''port3'' </nowiki></pre> Adding the -v option specifies that the request is verbose giving some feedback to the command, so if your target server IP was 192.168.1.250, the command and feedback would be: <pre><nowiki> knock -v 192.168.1.250 7000,8000,9000 hitting tcp 192.168.1.250:7000 hitting tcp 192.168.1.250:8000 hitting tcp 192.168.1.250:9000 </nowiki></pre> If everything is working correctly, this should prompt the target server to open the hole in the firewall to allow access so you can then connect to your application. == Notice == Simple portknocking daemons (such as knockd) are vulnerable because a sniffer may recover the port sequence that was used. A better solution is Cryptknock (http://cryptknock.sourceforge.net/) Cryptknock's description says: "Cryptknock is an encrypted port knocking tool. Unlike other port knockers which use TCP ports or other protocol information to signal the knock, an encrypted string is used as the knock. This makes it extremely difficult for an eavesdropper to recover your knock (unlike other port knockers where tcpdump can be used to discover a port knock)." == Links == [http://portknocking.org The orginal project] Detailed explanations on how it works and a reference implementation. [http://www.zeroflux.org/knock The port knocking daemon] The Ubuntu package is build from this release. A Win32 package is also available. You will also find other examples and some documentation. == See Also == * [[UbuntuHelp:SinglePacketAuthorization|SinglePacketAuthorization]] ---- [[category:CategorySecurity]] [[category:UbuntuHelp]]
该页面使用的模板:
模板:From
(
查看源代码
)
模板:Languages
(
查看源代码
)(受保护)
模板:Languages/Lang
(
查看源代码
)(受保护)
返回至
UbuntuHelp:PortKnocking
。