Fred Stluka from Bristle.com just introduced me to port knocking — a method of opening ports on a firewall by trying to connect with a series of ports in a pre-determined order. The sequence of “knocks” acts like a secret access code — like tapping out the first couple of bars from your favorite song to tell someone inside that it’s you. Similar secret taps were used during Prohibition to ensure that only those who knew the secret knock would be allowed into the speakeasies. These days, port knocking provides a way to forge access through a firewall by using the code.
Port knocking is usually implemented via some kind of daemon that watches the firewall logs for signs of the knock sequence and then modifying the firewall’s configuration to permit access through a specified port. You might use it on your home firewall to allow you to access your home network from the office or to provide a temporary back door to a network and then close it again after use.
Generally, a sequence of three or more knocks is used to complicate the access. If a single knock were used, it would obviously be too easy. Guessing the right sequence of three or four port numbers, on the other hand, greatly reduces the likelihood that anyone would be able to guess their way into your network.
Port knocking is customizable. You can select the port numbers and change the sequence as often as you feel is needed. As Wikipedia points out, you aren’t limited to using this technique to open ports. You might use port knocking to initiate a shell script set up to do just about anything — restart your web server, start your backups or run a scan of some sort.
Some port knocking schemes are ruggedized with highly secure cryptographic hashes. Some add blacklists and whitelists to ensure that only knocks from acceptable locations are heeded.
Some home-sized routers support port knocking. I’ve also heard that some folks are setting it up using iptables on their Linux boxes. Interesting idea! Thanks, Fred, for another useful tip!
Bristle Software can be reached at http://www.bristle.com/.
