My previous post about dynamic port knocking accidentally accepted
connections to the ports being knocked. Here is an updated action.Set
which resolves this:
---
?format 2
SetEvent($1,COUNT) - -
---
COUNT basically acts as a NOP allowing you to handle accepting or
dropping the port later on in 'rules'.
Note that you should either accept (when something is listening on that
port) or drop the connections to the 'knocking' ports as well as drop
connections by default. If you were to reject these ports then an
attacker might be able to figure which ports are used for knocking by
measuring the the difference in response time of the RST packet between
knocking and non-knocking ports.
Laurens
On 24-4-2015 10:38, Laurens Blankers wrote:
> The Shorewall documentation provides a custom Perl action to perform
> stateful port knocking:
>
> http://shorewall.net/Events.html#Stateful
>
> However I believe it is also possible using just the events
> functionality without any custom code.
>
> Here are the rules I use to achieve the same result:
>
> # IF connection on port 52245 THEN set event A1
> Set(A1) net $FW tcp 52245
> # IF connection on port 15623 AND event A1 is set THEN set event A2
> CondSet(A1,A2) net $FW tcp 15623
> # IF connection on port 19845AND event A2 is set THEN set event A3
> CondSet(A2,A3) net $FW tcp 19845
> # IF connection on port 22 AND event A3 is set THEN accept
> Cond(A3) net $FW tcp 22
>
> And here are the custom actions:
>
> action.Set:
> ---
> ?format 2
> SetEvent($1) - -
> ---
>
> action.CondSet:
> ---
> ?format 2
> DEFAULTS -,-,60
> IfEvent($1,Set($2):info,$3) - -
> ---
>
> action.Cond:
> ---
> ?format 2
> DEFAULTS -,ACCEPT,60
> IfEvent($1,$2:info,$3) - -
> ---
>
> (don't forget to add them to actions as well)
>
> Enjoy,
>
> Laurens
>
> PS. There works regardless of the issue I reported earlier regarding
> the order of matchers
>
>
> ------------------------------------------------------------------------------
> One dashboard for servers and applications across Physical-Virtual-Cloud
> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable Insights
> Deep dive visibility with transaction tracing using APM Insight.
> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
>
>
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
