Home / server / Questions / 86969
Accepted
Alex R
Asked: 2009-11-22 10:24:20 +0800 CST

Is there a robust, low-hassle solution for "port-knocking" based protection of SSH ports?

  • 772

By robust and low-hassle I mean NOT involving complex iptables setups, NOT involving apache, NOT requiring an additional client program, NOT requiring fragile shell scripts running from cron, etc.

Does anybody have sshd & ssh (client) patches to enable some form of port-knocking built-in to the sshd service & client itself?

For instance, rejecting connections on Port 22 until a properly encrypted and verified UDP packet is received, would be nice.

I'm disappointed that all port-knocking solutions out there are shameless hacks, rather than a nicely integrated and tested patch to the programs in question.

firewall

1 Answers

  1. Best Answer

    knockd seems to be one of the more established implementations, although doesn't fit your criteria of being a patch to sshd itself. Personally I'd favour an external program for reasons including:

    • it can be used to help secure other services (e.g. IMAP, OpenVPN) as well as ssh
    • patching extra functionality into sshd increases likelihood of introducing vulnerabilities (no matter how "tested" such a patch may be, sshd runs as root so the smallest flaw could prove to be quite nasty)
    • 6