Port knocking script/server for fedora?

[Bill Oliver]

On Wed, 19 Nov 2014, Patrick O'Callaghan wrote:

>
> On Tue, 2014-11-18 at 21:25 -0600, Bruno Wolff III wrote:
>> On Wed, Nov 19, 2014 at 01:36:46 +0000,
>>   Bill Oliver <vendor at billoblog.com> wrote:
>>>
>>> I've been reading a bit about port knocking as a security tool.  It makes pretty good sense for a private box, at least for stuff like ssh and ftp.   Does anybody know of a good tutorial/example/script for fedora for this?
>>
>> If your threat is password guessing, you can use two factor.
>> It is easy to require both a password and a public key to connect, with
>> the public key authentication required before any guessing of the password
>> can be done.
>>
>> If your threat is preauthentication attacks versus the service itself, using
>> a firewall is probably simpler. But you need to be able to restrict the
>> allowed IPs to some small fraction of the internet. And there may be blind
>> spoofing attacks that can get through the firewall. Port knocking can
>> provide some additional coverage, but this adds risk of the port knocking
>> service having bugs, extra work setting things up, and it isn't going to
>> stop some potential attackers.
>
> If the main concern is ssh hacking, you might consider denyhosts (yum
> install denyhosts). It's easy to set up and seems to be effective. The
> logs make fascinating (and scary) reading.
>
> And of course for ftp you *are* using sftp aren't you? In that case
> you're covered as well.
>
> poc
>

Well, to be honest, I don't know of any big specific threats other than
the usual random people from China, Russia, and Korea that seem to attack
everybody.  And there's some guy in France that knocks on my door every
now and then.  I use denyhosts, and it works well, and yeah, I use sftp.

I was just reading about port knocking and thought I'd play with it a bit
to see how much of a hassle it was to use.

billo