特殊:Badtitle/NS100:PortKnocking:修订间差异
小 新页面: {{From|https://help.ubuntu.com/community/PortKnocking}} {{Languages|UbuntuHelp:PortKnocking}} == What is Port Knocking ? == Port knocking is a simple and great method to grant remote acc... |
小无编辑摘要 |
||
第3行: | 第3行: | ||
== What is Port Knocking ? == | == What is Port Knocking ? == | ||
Port knocking is a simple | Port knocking is a simple method to grant remote access without leaving a port constantly open. This preserves your server from port scanning and script kiddie attacks. | ||
To utilize port knocking, the server must have a firewall and run the knock-daemon. As the name | To utilize port knocking, the server must have a firewall and run the knock-daemon. As the name conveys, the daemon is listening for a specific sequence of TCP or UDP "knocks". If the sequence is given correctly, then a command is executed; typically the source IP address is given access through the firewall to the port of an application (such as SSH). This method is reasonably secure, as port knocking is located at a very low level in the TCP/IP stack and does not require any opened ports. The knock-daemon is also invisible to potential attackers. | ||
On the client side, the only thing | On the client side, the only thing needed is to play the sequence with the client of your choice (such as '''knock'''). | ||
== Server Setup == | == Server Setup == | ||
The setup of the server is | The setup of the server is straightforward. First, ensure that your server has a running firewall. Then, install the <code><nowiki>knockd</nowiki></code> package (see InstallingSoftware). | ||
After the package is installed, edit its configuration file. Two approaches are presented below: the first is intended for connections with no keep-alive (such as HTTP), while the other is intended for permanent connections (such as SSH and IRC). | |||
== Example 1 == | == Example 1 == | ||
<pre><nowiki> | <pre><nowiki> | ||
第25行: | 第21行: | ||
logfile = /var/log/knockd.log | logfile = /var/log/knockd.log | ||
[ | [openHTTP] | ||
sequence = 7000,8000,9000 | sequence = 7000,8000,9000 | ||
seq_timeout = 5 | seq_timeout = 5 | ||
第31行: | 第27行: | ||
tcpflags = syn | tcpflags = syn | ||
[ | [closeHTTP] | ||
sequence = 9000,8000,7000 | sequence = 9000,8000,7000 | ||
seq_timeout = 5 | seq_timeout = 5 | ||
第41行: | 第37行: | ||
Here we have defined two sequences : | Here we have defined two sequences : | ||
** ''' | ** '''openHTTP''' opens the HTTP port if the 7000, 8000 and 9000 port sequence is "knocked" | ||
** ''' | ** '''closeHTTP''' closes the HTTP port if the 9000, 8000 and 7000 port sequence is "knocked" | ||
== Example 2 == | == Example 2 == | ||
The second example | The second example is a bit different from the original: | ||
<pre><nowiki> | <pre><nowiki> | ||
options] | [options] | ||
logfile = /var/log/knockd.log | logfile = /var/log/knockd.log | ||
第61行: | 第57行: | ||
</nowiki></pre> | </nowiki></pre> | ||
It's recommended to open the port for a short time (ten seconds, in this example). For this to be functional, you must have a state-full firewall running on your server (there must be a rule to accept connections with <code><nowiki>-m state --state RELATED,ESTABLISHED</nowiki></code>). | |||
Let's explain this configuration file. If a user "knocks" on ports 7000, 8000 and 9000 (in order), the command will be played (opening port 22). Ten seconds later, the <code><nowiki>stop_command</nowiki></code> will be executed, closing the port to new connections. | |||
Do not forget to change the sequence (this is the example provided by the default installation) and, of course provide the sequence to your users. | |||
You must also change the default configuration file <code><nowiki>/etc/default/knockd</nowiki></code> for the knockd daemon to start. Uncomment the START_KNOCKD=1 line to enable the daemon. | |||
That's it! | |||
That's it ! | |||
== Client Side == | == Client Side == | ||
On the client side, you can "knock" with | On the client side, you can "knock" with the client of your choice: <code><nowiki>telnet</nowiki></code>, <code><nowiki>nc</nowiki></code> or even the software used to connect to the server (for example <code><nowiki>ssh</nowiki></code>). If you do not use a client designed for portknocking, you must do the knock sequence manually. | ||
An easier method is to use the knock client. Install the <code><nowiki>knockd</nowiki></code> package (see InstallingSoftware). | |||
For knocking, | For knocking, launch the command: | ||
<pre><nowiki> | <pre><nowiki> | ||
第110行: | 第81行: | ||
Then connect to your application. | Then connect to your application. | ||
== | == Notice == | ||
Simple portknocking daemons (such as knockd) are vulnerable because a sniffer may recover the port sequence that was used. | |||
Simple portknocking daemons as knockd are vulnerable because a sniffer may recover | |||
A better solution is Cryptknock (http://cryptknock.sourceforge.net/) | A better solution is Cryptknock (http://cryptknock.sourceforge.net/) | ||
Cryptknock's description says: | Cryptknock's description says: | ||
"Cryptknock is an encrypted port knocking tool. Unlike other port knockers which use TCP ports or other protocol information to signal the knock, an encrypted string is used as the knock. This makes it extremely difficult for an | "Cryptknock is an encrypted port knocking tool. Unlike other port knockers which use TCP ports or other protocol information to signal the knock, an encrypted string is used as the knock. This makes it extremely difficult for an eavesdropper to recover your knock (unlike other port knockers where tcpdump can be used to discover a port knock)." | ||
== Links == | == Links == | ||
第126行: | 第94行: | ||
[http://www.zeroflux.org/knock The port knocking daemon] The Ubuntu package is build from this release. A Win32 package is also available. You will also find other examples and some documentation. | [http://www.zeroflux.org/knock The port knocking daemon] The Ubuntu package is build from this release. A Win32 package is also available. You will also find other examples and some documentation. | ||
---- | ---- | ||
[[category: | [[category:CategorySecurity]] [[category:CategoryDocumentation]] | ||
[[category:UbuntuHelp]] | [[category:UbuntuHelp]] |
2007年11月21日 (三) 18:18的版本
文章出处: |
{{#if: | {{{2}}} | https://help.ubuntu.com/community/PortKnocking }} |
点击翻译: |
English {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/af | • {{#if: UbuntuHelp:PortKnocking|Afrikaans| [[::PortKnocking/af|Afrikaans]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ar | • {{#if: UbuntuHelp:PortKnocking|العربية| [[::PortKnocking/ar|العربية]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/az | • {{#if: UbuntuHelp:PortKnocking|azərbaycanca| [[::PortKnocking/az|azərbaycanca]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/bcc | • {{#if: UbuntuHelp:PortKnocking|جهلسری بلوچی| [[::PortKnocking/bcc|جهلسری بلوچی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/bg | • {{#if: UbuntuHelp:PortKnocking|български| [[::PortKnocking/bg|български]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/br | • {{#if: UbuntuHelp:PortKnocking|brezhoneg| [[::PortKnocking/br|brezhoneg]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ca | • {{#if: UbuntuHelp:PortKnocking|català| [[::PortKnocking/ca|català]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/cs | • {{#if: UbuntuHelp:PortKnocking|čeština| [[::PortKnocking/cs|čeština]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/de | • {{#if: UbuntuHelp:PortKnocking|Deutsch| [[::PortKnocking/de|Deutsch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/el | • {{#if: UbuntuHelp:PortKnocking|Ελληνικά| [[::PortKnocking/el|Ελληνικά]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/es | • {{#if: UbuntuHelp:PortKnocking|español| [[::PortKnocking/es|español]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/fa | • {{#if: UbuntuHelp:PortKnocking|فارسی| [[::PortKnocking/fa|فارسی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/fi | • {{#if: UbuntuHelp:PortKnocking|suomi| [[::PortKnocking/fi|suomi]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/fr | • {{#if: UbuntuHelp:PortKnocking|français| [[::PortKnocking/fr|français]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/gu | • {{#if: UbuntuHelp:PortKnocking|ગુજરાતી| [[::PortKnocking/gu|ગુજરાતી]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/he | • {{#if: UbuntuHelp:PortKnocking|עברית| [[::PortKnocking/he|עברית]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/hu | • {{#if: UbuntuHelp:PortKnocking|magyar| [[::PortKnocking/hu|magyar]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/id | • {{#if: UbuntuHelp:PortKnocking|Bahasa Indonesia| [[::PortKnocking/id|Bahasa Indonesia]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/it | • {{#if: UbuntuHelp:PortKnocking|italiano| [[::PortKnocking/it|italiano]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ja | • {{#if: UbuntuHelp:PortKnocking|日本語| [[::PortKnocking/ja|日本語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ko | • {{#if: UbuntuHelp:PortKnocking|한국어| [[::PortKnocking/ko|한국어]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ksh | • {{#if: UbuntuHelp:PortKnocking|Ripoarisch| [[::PortKnocking/ksh|Ripoarisch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/mr | • {{#if: UbuntuHelp:PortKnocking|मराठी| [[::PortKnocking/mr|मराठी]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ms | • {{#if: UbuntuHelp:PortKnocking|Bahasa Melayu| [[::PortKnocking/ms|Bahasa Melayu]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/nl | • {{#if: UbuntuHelp:PortKnocking|Nederlands| [[::PortKnocking/nl|Nederlands]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/no | • {{#if: UbuntuHelp:PortKnocking|norsk| [[::PortKnocking/no|norsk]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/oc | • {{#if: UbuntuHelp:PortKnocking|occitan| [[::PortKnocking/oc|occitan]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/pl | • {{#if: UbuntuHelp:PortKnocking|polski| [[::PortKnocking/pl|polski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/pt | • {{#if: UbuntuHelp:PortKnocking|português| [[::PortKnocking/pt|português]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ro | • {{#if: UbuntuHelp:PortKnocking|română| [[::PortKnocking/ro|română]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/ru | • {{#if: UbuntuHelp:PortKnocking|русский| [[::PortKnocking/ru|русский]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/si | • {{#if: UbuntuHelp:PortKnocking|සිංහල| [[::PortKnocking/si|සිංහල]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/sq | • {{#if: UbuntuHelp:PortKnocking|shqip| [[::PortKnocking/sq|shqip]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/sr | • {{#if: UbuntuHelp:PortKnocking|српски / srpski| [[::PortKnocking/sr|српски / srpski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/sv | • {{#if: UbuntuHelp:PortKnocking|svenska| [[::PortKnocking/sv|svenska]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/th | • {{#if: UbuntuHelp:PortKnocking|ไทย| [[::PortKnocking/th|ไทย]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/tr | • {{#if: UbuntuHelp:PortKnocking|Türkçe| [[::PortKnocking/tr|Türkçe]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/vi | • {{#if: UbuntuHelp:PortKnocking|Tiếng Việt| [[::PortKnocking/vi|Tiếng Việt]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/yue | • {{#if: UbuntuHelp:PortKnocking|粵語| [[::PortKnocking/yue|粵語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/zh | • {{#if: UbuntuHelp:PortKnocking|中文| [[::PortKnocking/zh|中文]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/zh-hans | • {{#if: UbuntuHelp:PortKnocking|中文(简体)| [[::PortKnocking/zh-hans|中文(简体)]]}}|}} {{#ifexist: {{#if: UbuntuHelp:PortKnocking | UbuntuHelp:PortKnocking | {{#if: | :}}PortKnocking}}/zh-hant | • {{#if: UbuntuHelp:PortKnocking|中文(繁體)| [[::PortKnocking/zh-hant|中文(繁體)]]}}|}} |
{{#ifeq:UbuntuHelp:PortKnocking|:PortKnocking|请不要直接编辑翻译本页,本页将定期与来源同步。}} |
{{#ifexist: :PortKnocking/zh | | {{#ifexist: PortKnocking/zh | | {{#ifeq: {{#titleparts:PortKnocking|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:PortKnocking|1|-1|}} | zh | | }}
What is Port Knocking ?
Port knocking is a simple method to grant remote access without leaving a port constantly open. This preserves your server from port scanning and script kiddie attacks.
To utilize port knocking, the server must have a firewall and run the knock-daemon. As the name conveys, the daemon is listening for a specific sequence of TCP or UDP "knocks". If the sequence is given correctly, then a command is executed; typically the source IP address is given access through the firewall to the port of an application (such as SSH). This method is reasonably secure, as port knocking is located at a very low level in the TCP/IP stack and does not require any opened ports. The knock-daemon is also invisible to potential attackers.
On the client side, the only thing needed is to play the sequence with the client of your choice (such as knock).
Server Setup
The setup of the server is straightforward. First, ensure that your server has a running firewall. Then, install the knockd
package (see InstallingSoftware).
After the package is installed, edit its configuration file. Two approaches are presented below: the first is intended for connections with no keep-alive (such as HTTP), while the other is intended for permanent connections (such as SSH and IRC).
Example 1
[options] logfile = /var/log/knockd.log [openHTTP] sequence = 7000,8000,9000 seq_timeout = 5 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 80 -j ACCEPT tcpflags = syn [closeHTTP] sequence = 9000,8000,7000 seq_timeout = 5 command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 80 -j ACCEPT tcpflags = syn
Here we have defined two sequences :
- openHTTP opens the HTTP port if the 7000, 8000 and 9000 port sequence is "knocked"
- closeHTTP closes the HTTP port if the 9000, 8000 and 7000 port sequence is "knocked"
Example 2
The second example is a bit different from the original:
[options] logfile = /var/log/knockd.log [SSH] sequence = 7000,8000,9000 seq_timeout = 5 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn cmd_timeout = 10 stop_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
It's recommended to open the port for a short time (ten seconds, in this example). For this to be functional, you must have a state-full firewall running on your server (there must be a rule to accept connections with -m state --state RELATED,ESTABLISHED
).
Let's explain this configuration file. If a user "knocks" on ports 7000, 8000 and 9000 (in order), the command will be played (opening port 22). Ten seconds later, the stop_command
will be executed, closing the port to new connections.
Do not forget to change the sequence (this is the example provided by the default installation) and, of course provide the sequence to your users.
You must also change the default configuration file /etc/default/knockd
for the knockd daemon to start. Uncomment the START_KNOCKD=1 line to enable the daemon.
That's it!
Client Side
On the client side, you can "knock" with the client of your choice: telnet
, nc
or even the software used to connect to the server (for example ssh
). If you do not use a client designed for portknocking, you must do the knock sequence manually.
An easier method is to use the knock client. Install the knockd
package (see InstallingSoftware).
For knocking, launch the command:
knock ''hostname'' ''port1'' ''port2'' ''port3''
Then connect to your application.
Notice
Simple portknocking daemons (such as knockd) are vulnerable because a sniffer may recover the port sequence that was used. A better solution is Cryptknock (http://cryptknock.sourceforge.net/) Cryptknock's description says: "Cryptknock is an encrypted port knocking tool. Unlike other port knockers which use TCP ports or other protocol information to signal the knock, an encrypted string is used as the knock. This makes it extremely difficult for an eavesdropper to recover your knock (unlike other port knockers where tcpdump can be used to discover a port knock)."
Links
The orginal project Detailed explanations on how it works and a reference implementation.
The port knocking daemon The Ubuntu package is build from this release. A Win32 package is also available. You will also find other examples and some documentation.