1

I am trying to implement port knocking for ssh service on my personal server. I have two other public services that will always be open. My iptables rules look like this:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source         destination         
 7229  545K ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:4352
0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:25565

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 448 bytes)
 pkts bytes target     prot opt in     out     source               destination

My knockd.conf file in at /etc/knockd.conf looks like this:

[options]
 logfile = /var/log/knockd.log

[SSH]
sequence = 7000,8000,9000
seq_timeout = 15
tcpflags = syn
start_command = /sbin/iptables -D INPUT 1 -s %IP% -p tcp --dport ssh -j ACCEPT
cmd_timeout = 10
stop_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

I also have the file /etc/default/knockd

################################################
#
# knockd's default file, for generic sys config
#
################################################

# control if we start knockd at init or not
# 1 = start
# anything else = don't start
#
# PLEASE EDIT /etc/knockd.conf BEFORE ENABLING
START_KNOCKD=1

# command line options
#KNOCKD_OPTS="-i eth1"

Running sudo /etc/init.d/knockd restart runs normally. The log file simply says that knockd has started.

On the client side, I run knock -v $address 7000 8000 9000. Output says:

hitting tcp x.x.x.x:7000
hitting tcp x.x.x.x:8000
hitting tcp x.x.x.x:9000

However, attempting to connect yeilds no result, and the iptables rules are unchanged. What am I doing wrong?

EDIT

Of course, as soon as I post this question, my ssh terminal decides to die, and now I'm locked out of the server for two weeks until I can actually get to it. Take your time, it's not like I can do anything with the information any time soon.

2

I see nothing wrong with anything you've posted, so you'll probably need to troubleshoot (after verifying ps -aux|grep knockd or tail'ing the knockd log on the server proves knockd is running):

  • I would enter a command in iptables that logs the incomings from your knocking PC, then use tail -f on the /var/log/kern.log file to see if the ports you have chosen are being allowed through end-to-end. Be aware your system might not use the /var/log/kern.log file, although mine does.

Example - (enter this on the knockd server with su power, cxx.xxx.xxx.xxx is the IP address of the client knocker) iptables -w -I INPUT 1 -s cxx.xxx.xxx.xxx -j LOG; tail -n-0 -f /var/log/kern.log|stdbuf -o0 grep cxx.xxx.xxx.xxx

Then send the knocks from the client, watching the output of the command above. If the knocks aren't getting logged, then on the client command line separate each port knock by sleep 1. The command line for that would look like knock sxx.xxx.xxx.xxx nnnn1;sleep1;knock sxx.xxx.xxx.xxx nnnn2;sleep 1;knock sxx.xxx.xxx.xxx nnnn3;sleep 1... where sxx.xxx.xxx.xxx is the IP of the server and nnnn1,2,3,4 are the ports in the knock sequence. If that still doesn't work use the logging technique on your client (install iptables/netfilter and put a LOG rule in OUTPUT chain with -d sxx.xxx.xxx.xxx; tail -f the client log file)

If you find all the knocks are getting logged just fine on the client knocker, then additional troubleshooting steps are called for. (1st step - Be sure your knockd.conf is getting found by knockd as it starts.) Post your results for help with further troubleshooting. The ISP at one end or the other or your [wifi] router might be blocking higher numbered ports. I found that my cell phone provider's network seemed to block my knocks from my smartphone.

1

I know this is quite old, but I think I see your problem

Your start command is start_command = /sbin/iptables -D

That should be -A not -D

0

insted of adding it is better to insert so try -I

some improvments are marked : * *

[options]

***useSyslog***

logfile = /var/log/knockd.log

[SSH] sequence = 7000,8000,9000 seq_timeout = 15 tcpflags = syn start_command = /sbin/iptables -I INPUT 1 -s %IP% -p tcp --dport ssh -j ACCEPT cmd_timeout = 10 stop_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.