alt Hacker NewsWhy not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you clearly already have ssh.
Replies
That's a good idea, but on the other hand, it seems inappropriate to use such lore in the manner of a lore-master in these suspicious days; not a fitting reference for the happier times of Durin.
It's easier as in using already known tools. It's potentially less secure because sshd is vastly more complex, and allows literal (authorized) remote code execution, unlike fwknop.
I threw an example together with Sol: Knoxbox https://github.com/rektide/knoxbox
It assumes systemd, which it uses to start sshd. It also restarts a systemd timer to shut sshd down in 5m. Ssh is set up (by defualt on Debian) to have KillMode=process, leaving the client instances alive, just killing the listen server.
Why even type anything? Just ssh to 7000, and use the same public key to authenticate. The server responds with “You’re in”, opens up 22 and closes the connection. You then ssh normally.
This bespoke server should not advertise it in any special way though (generic OpenSSH banner), and can be used to also ban port scanners if they try to do something fishy.
fwknop is impossible to even scan for, though, so it’s a bit more robust in that sense.