Beyond Security Port Knocking Presentation on Noam Rathaus

Beyond Security Port Knocking Presentation on Noam Rathaus CTO Sunday, July 11, 2004 Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Paradigm • Port Knocking A perfectly secure system does not permit any external connections to it Such a computer, though protected, is impractical: • Nobody can connect, regardless of their trust level • This essentially describes a computer that is not networked • These systems are not a lot of fun. . . Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Extension to Paradigm • Trusted user sees “a live host” Port Knocking • Permits connections from user to server • Untrusted user sees “a dead host” • Connections to server are blocked How do we discriminate between trusted and untrusted users? Today this is done by Firewalls/VPN's Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Limitations • Port Knocking Firewalls authorize access by IP address. Problems: • • • Dynamic addresses Roaming users VPN's authorize by authentication. Problems: • • Needs complicated software (VPN client) VPN is per-network and not per-service Port knocking to the rescue! Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Introduction 1/4 • Port Knocking • • This illustration shows a server which is running four services and which has no Firewall All ports are open Remote computers will successfully connect to four ports: ftp/21, smtp/25, http/80 and pop/110 Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Introduction 2/4 • Port Knocking • • Firewalled Server listens on port ssh/22 Connections to the server are seamlessly blocked to all users However, once a user completes a port knocking sequence, connections are allowed Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Introduction 3/4 • Port Knocking • • Port knocking is a method of establishing a connection to a networked computer that has no open ports Before a connection is established, ports are opened using a port knock sequence, which is a series of connection attempts to closed ports A remote host generates and sends an authentic knock sequence in order to manipulate the server's firewall rules to open one or more specific ports Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Introduction 4/4 • Port Knocking • These manipulations are mediated by a port knock daemon, running on the server, which monitors the firewall log file for connection attempts which can be translated into authentic knock sequences Once the desired ports are opened, the remote host can establish a connection and begin a session. Another knock sequence may used to trigger the closing of the port Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

What is it good for? • Port Knocking • • Port knocking is best for hosts that provide services to authorized users who require continual access to services and data from any location Port knocking is not suitable for hosts running public services, such as SMTP or HTTP Port knocking is used to keep all ports closed to public traffic while flexibly opening and closing ports to traffic from users who have authenticated themselves with a knock sequence Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

What else? • Port Knocking This on-demand IP-based filtering which is triggered by a remote user can offers the advantages of IPbased filtering without the limitation usually associated with maintaining IP rules Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

What isn’t it? • Port Knocking Port knocking cannot be used to protect public services - such protection cannot be effective if the knock sequence, or a method to generate it, is made public Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Why is it so exciting? • Port Knocking • • • Port knocking is not a listening service – it is not exposed to network attacks There is no way to detect a portknocking server (unlike a firewall that can be detected) The port seems closed – because they are closed! In security, simple mechanism = less probability for weaknesses Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Why not just a Firewall? • Port Knocking • • Firewalls define and limit the communication possible within a network System administrators tend to be paranoid (good!) and need to enforce limits to help monitoring and troubleshooting Unless you are very familiar with your operating system, you may not be aware of all the services running on your computer Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Summarize • Port Knocking Port knocking can be used whenever there is a need to transfer information across closed ports • The port knock daemon can be implemented to respond in any suitable way to an authentic port knock • The knock may be used to communicate the knock information silently and/or to trigger an action. This is a form of IP over closed ports Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Simple Implementation • Port Knocking • • • The simplest implementation of port knocking uses a log file to interface with the firewall software This simple approach makes port knocking highly accessible for home users The protected services do not require any modification This form of port knocking is relatively easy to set up Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Best Practice • Port Knocking Port knocking is ideally suitable for remote administration provided by a latent, on-demand SSH service. In other cases port knocking may not be the right answer Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Some History • cd 00 r / SAdoor Port Knocking • cd 00 r. c and SAdoor are working proof-ofconcept codes for a not listening remote shell on UN*X systems • A listener in non-promiscuous mode looking for a specific sequence of packets before actually opening any kind of listener. • This sequence can be any kind of IP traffic for obscurity • Used primarily as stealth backdoors Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

What is needed? • knockclient Port Knocking • a port knocking client responsible for sending knocks to remote firewall where a knockdaemon is listening • knockdaemon • a port knocking server responsible for monitoring and responding to incoming knocks generated by knockclient Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Port Knocking Client “Flavors” • Port Knocking • • There are port knocking implementations in Perl, C/C++, Java, python and even BASH The easiest to implement is Python, Perl and BASH The implementation use the logs generated by IPTABLES to discover when someone knocked on the Firewall in the right way Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

What’s next? 1/3 • Port Knocking • Suppose you have a networked system and you need to connect using ssh To close all other ports, use: ipchains -p tcp -s 0/0 -d FIREWALL/32 -p 0: 1023 -j DENY -l ipchains -p tcp -s 0/0 -d FIREWALL/32 -p 1024: 49151 -j DENY • Each connection attempt will be logged: Feb 12 00: 13: 26. . . input DENY. . . CLIENT: 64137 FIREWALL: 102. . . Feb 12 00: 13: 27. . . input DENY. . . CLIENT: 64138 FIREWALL: 100. . . Feb 12 00: 13: 27. . . input DENY. . . CLIENT: 64139 FIREWALL: 100. . . Feb 12 00: 13: 28. . . input DENY. . . CLIENT: 64140 FIREWALL: 103. . . Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

What’s next? 2/3 • Port Knocking • • A daemon monitoring the log file can detect these connection attempts to ports 102, 100, 103 from the same IP address This particular port sequence could trigger the daemon to open port ssh/22 The daemon would execute the following command ipchains -I input -p tcp -s CLIENT/32 -d FIREWALL/32 22 -j ACCEPT Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

What’s next 3/3 • Port Knocking • Another sequence can be used to close the port For example, 103, 100, 102 could be used to trigger the deletion of the rule that was dynamically created to allow CLIENT to connect ipchains -D input -p tcp -s CLIENT/32 -d FIREWALL/32 22 -j ACCEPT • In this example, a remote user has opened port ssh/22 to IP address CLIENT by making TCP connections to ports 102, 100, 103 and subsequently closed the ssh/22 port to their IP by knocking on ports 103, 100, 102 Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Enhancements • Encrypted Port Knocks Port Knocking • The 4 -port knocks in the previous example provided limited protection against packet sniffing, since the knock was independent of the connecting IP address • Anyone on the network looking at packets could reconstruct the sequence and use it to gain access to the ssh/22 port • In order to reduce the risk of the knock being deconstructed and gainfully executed by a third -party, it should contain the client IP address and be encrypted Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com

Port Knocking Questions? noamr@beyondsecurity. com Beyond Security Ltd. www. Beyond. Security. com www. Secur. ITeam. com