Fedora 21 Update: fwknop-2.6.6-1.fc21

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-10930
2015-06-30 17:56:27
--------------------------------------------------------------------------------

Name        : fwknop
Product     : Fedora 21
Version     : 2.6.6
Release     : 1.fc21
URL         : http://www.cipherdyne.org/fwknop/
Summary     : A Single Packet Authorization (SPA) implementation
Description :
fwknop implements an authorization scheme known as Single Packet
Authorization (SPA) that requires only a single encrypted packet to
communicate various pieces of information including desired access through an
iptables policy and/or specific commands to execute on the target system.
The main application of this program is to protect services such as SSH with
an additional layer of security in order to make the exploitation of
vulnerabilities (both 0-day and unpatched code) much more difficult.  The
authorization server passively monitors authorization packets via libpcap and
hence there is no "server" to which to connect in the traditional sense.  Any
service protected by fwknop is inaccessible (by using iptables to
intercept packets within the kernel) before authenticating; anyone scanning for
the service will not be able to detect that it is even listening.  This
authorization scheme offers many advantages over port knocking, include being
non-replayable, much more data can be communicated, and the scheme cannot be
broken by simply connecting to extraneous ports on the server in an effort to
break knock sequences.  The authorization packets can easily be spoofed as
well, and this makes it possible to make it appear as though, say,
www.yahoo.com is trying to authenticate to a target system but in reality the
actual connection will come from a seemingly unrelated IP. Although the
default data collection method is to use libpcap to sniff packets off the
wire, fwknop can also read packets out of a file that is written by the
iptables ulogd pcap writer or by a separate sniffer process.

--------------------------------------------------------------------------------
Update Information:

This update provides new upstream release and fixes problems with dependency on Firewalld.
--------------------------------------------------------------------------------
ChangeLog:

* Mon Jun 29 2015 Jakub Jelen <jjelen at redhat.com> 2.6.6-1
- New upstream release
- Fix problematic firewalld dependency (#1236331)
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 2.6.5-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Tue Apr  7 2015 Jakub Jelen <jjelen at redhat.com> 2.6.5-2
- Add possibility to use gpg and firewalld (#976453)
* Tue Apr  7 2015 Jakub Jelen <jjelen at redhat.com> 2.6.5-1
- New upstream release
* Wed Feb 25 2015 Jakub Jelen <jjelen at redhat.com> 2.6.3-2
- Make service start after network (#1195303)
- Update install scriptlet for systemd (#850124)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1236331 - fwknopd on Fedora Server 21, Warning: could not use the 'comment' match
        https://bugzilla.redhat.com/show_bug.cgi?id=1236331
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use
su -c 'yum update fwknop' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------