[fwknop] Single Packet Authorization and Port Knocking
fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports iptables on Linux, ipfw on FreeBSD and Mac OS X, and PF on OpenBSD) and libpcap. SPA is essentially next generation port knocking (more on this below).
Features
- Implements Single Packet Authorization around iptables firewalls on Linux, ipfwfirewalls on *BSD and Mac OS X, and PF on OpenBSD.
- The fwknop client runs on Linux, Mac OS X, *BSD, and Windows (under Cygwin). There is also a separate Windows UI. In addition, there is a port of the client to both the iPhone and Android phones.
- Supports both Rijndael and GnuPG methods for the encryption/decryption of SPA packets.
- Supports HMAC authenticated encryption for both Rijndael and GnuPG. The order of operation is encrypt-then-authenticate to avoid various cryptanalytic problems.
- Replay attacks are detected and thwarted by SHA-256 digest comparison of valid incoming SPA packets. SHA-1 and MD5 are also supported, but SHA-256 is the default.
- SPA packets are passively sniffed from the wire via libpcap. The fwknop server can also acquire packet data from a file that is written to by a separate Ethernet sniffer (such as with "tcpdump -w
"), or from the iptables ULOG pcap writer. - fwknop is open source software released under the GPL (v2).
- For iptables firewalls, ACCEPT rules added by fwknop are added and deleted (after a configurable timeout) from custom iptables chains so that fwknop does not interfere with any existing iptables policy.
- Supports inbound NAT connections for authenticated SPA communications (iptables firewalls only for now). This means that fwknop can be configured to create DNATrules so that you can reach a service (such as SSH) running on an internal system on an RFC 1918 IP address from the open Internet.
- Multiple users are supported by the fwknop server, and each user can be assigned their own symmetric or asymmetric encryption key via the /etc/fwknop/access.conffile.
- Automatic resolution of external IP address via http://www.cipherdyne.org/cgi-bin/myip (this is useful when the fwknop client is run from behind a NAT device). Because the external IP address is encrypted within each SPA packet in this mode, Man-in-the-Middle (MITM) attacks where an inline device intercepts an SPA packet and only forwards it from a different IP in an effort to gain access are thwarted.
- Port randomization is supported for the destination port of SPA packets as well as the port over which the follow-on connection is made via the iptables NAT capabilities. The later applies to forwarded connections to internal services and to access granted to local sockets on the system running fwknopd.
- Integration with Tor (see my DefCon 14 presentation). Note that because Tor uses TCP for transport, sending SPA packets through the Tor network requires that each SPA packet is sent over an established TCP connection, so technically this breaks the "single" aspect of "Single Packet Authorization". However, Tor provides anonymity benefits that can easily outweigh this consideration in some deployments.
- Implements a versioned protocol for SPA communications, so it is easy to extend the protocol to offer new SPA message types and maintain backwards compatibility with older fwknop clients at the same time.
- Supports the execution of shell commands on behalf of valid SPA packets.
- The fwknop server can be configured to place multiple restrictions on inbound SPA packets beyond those enforced by encryption keys and replay attack detection. Namely, packet age, source IP address, remote user, access to requested ports, filtering regular expressions against commands, and more.
- Bundled with fwknop is a comprehensive test suite that issues a series of tests designed to verify that both the client and server pieces of fwknop work properly. These tests involve sniffing SPA packets over the local loopback interface, building temporary firewall rules that are checked for the appropriate access based on the testing config, and parsing output from both the fwknop client and fwknopd server for expected markers for each test. Test suite output can easily be anonymized for communication to third parties for analysis.
- fwknop was the first program to integrate port knocking with passive OS fingerprinting. However, Single Packet Authorization offers many security benefits beyond port knocking, so the port knocking mode of operation is generally deprecated.
[fwknop] Single Packet Authorization and Port Knocking
![[fwknop] Single Packet Authorization and Port Knocking](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdmfdv6GFsTebWHU9kfDyZTohv_DSCixclKzCdAJLNWxdIeqludunLKSVD_9fg16eA52AaBnt4itghO2AZYfdK-4CQf-9OYKzLJ90BHyWcXtZRMP7jLW3_RuOsXdYLClMy3k4OheZt9ws/s72-c/fwknop_tutorial_network_diagram.png)
Reviewed by 0x000216
on
Monday, January 20, 2014
Rating: 5
Reviewed by 0x000216
on
Monday, January 20, 2014
Rating: 5