TUTORIAL Knock 3 Times: knockd

[wardmundy]

 

[wardmundy]

Installers for both RedHat/CentOS/Fedora and Ubuntu/Debian are included in this week's Nerd Vittles article.

 

[Huckda]

I've been using knockd in some form or other since about 10 years ago... it works

 

[wardmundy]

As usual, we're late to the party.

 

[Huckda]

Better late than never!
It's just another layer of security/piece of mind
And seriously.. who can keep up with every little nuance piece of software out there for all of the different OS's, it really is ridiculous to even try.
Where I am.. the educational I.T. folk used to get together each month just to hash out what we've been looking at/trying/experimenting with/implementing...
Every month everyone learned something new to use or ignore...

 

[wardmundy]

FWIW: The current version of knockd is less than a month old. Judging from the history of the project, it's much improved over earlier releases both in terms of reliability and from a security standpoint. Same goes for the client history. Many of them still don't work reliably with all servers.

 

[howardsl2]

Thanks for the helpful article Ward.

An alternative to knockd is the pknock module provided by xtables-addons. It works entirely within IPTables with no external daemon required.

A tutorial for its installation and usage can be found on my blog:
IPTables GeoIP, Port Knocking and Port Scan Detection

Upon completion of install, run "man xtables-addons" to view detailed usage of all available modules. You can then search for pknock. (type /pknock Enter)

An example IPTables rule would look like this:

iptables -A INPUT -p tcp -m pknock --knockports 4002,4001,4004 --strict --name SSH --time 10 --autoclose 60 --dport 22 -j ACCEPT

 

[wardmundy]

knockd installer for ARM-based systems has been added to today's article. BBB has been tested and works fine. Raspberry Pi testing soon.

cd /root
wget http://nerdvittles.com/wp-content/knock-ARM.tar.gz
tar zxvf knock*
rm knock-ARM.tar.gz
./knock*

 

[miguel]

this looks great, I will try it, anyway is there a way to uninstalling jut in case?
best regards,

 

[wardmundy]

RedHat/CentOS: rpm -e packagename
Ubuntu/Debian: apt-get remove packagename

 

[miguel]

another question, if I unistall will the server be as it was before ? with the opened ports that I inputed before?

 

[miguel]

now I cant remove it it says that the package is not installed, what do I do?

 

[wardmundy]

What is the command you issued to uninstall it and on what platform?

 

[wardmundy]

another question, if I unistall will the server be as it was before ? with the opened ports that I inputed before?

Don't really have much of an idea what you've done so I can't really respond. You can restart iptables to wipe out any openings made by knockd if that's what you're asking.

 

[miguel]

I installed as metioned in the forum:

wget http://nerdvittles.com/wp-content/knock-R.tar.gz
tar zxvf knock*
rm knock-R.tar.gz
./knock*

then I wanted to unistall as you mentioned before :

rpm -e packagename (knock* or knockd tried both) and it tells me:
rpm -e knocked
error: package knocked is not installed

rpm -e knock*
error: package knock.FAQ is not installed
error: package knock-R.sh is not installed

but obviously if I get service knockd restart I get:

root@pbx:~ $ service knockd restart
Shutting down knockd: [ OK ]
Starting knockd: [ OK ]

so the service is installed so my question is how do I uninstall knockd on the server?

 

[islandtech]

rpm -e knocked
error: package knocked is not installed

did you try rpm -e knockd
is that the command in the quote you used?

 

[ukstevef]

rpm -e knocked
error: package knocked is not installed

You may have the name wrong try

rpm -e knockd

 

[wardmundy]

Actually, on the RedHat platform, it's rpm -e knock-server

You can get a list of installed packages using a wild card like this: yum list knock\*

OR yum list \* will get you everything

AND so will: yum list installed

 

[miguel]

that did the trick thanks a bunch, also by some strange reason it did not worked for me I tried to log in from my 3g connection on the cellphone without knocking and I registered, what could I be doing wrong?

 

[stucker]

Installers for both RedHat/CentOS/Fedora and Ubuntu/Debian are included in this week's Nerd Vittles article.

Ward, I'm eager to test whenever the Raspberry flavor is complete. Let me know if you'd need any beta testers? Thanks!