Hacker News Reader

Comment by LoganDark | Hacker News Reader

My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.

View on HN

That's not a knock, it's a password :-)

I mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...

Yes something like that has been done, the solution uses asymmetric cryptography instead of symmetric and it protects the entire communication stream instead of just opening the gates - it's called Wireguard.

I jest, but you're describing authentication protocol which uses the UDP destination port field to carry each character of the "one time password" in a roundabout way. You could simply send 1 packet containing the password to the daemon.

I've never seen it used in the wild but apparently, it exists: https://github.com/mrash/fwknop

LOL'd at Wireguard, but I really miss Plan 9-style networking, where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that.

Reading the fwknop README is such a breath of fresh air, thank you for that treat. I hate AI-generated documentation so much.

> where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that.

You can run wireguard in userspace with something like wireproxy which connects to a wireguard peer and acts as a proxy for your subprocess.

[1] https://github.com/windtf/wireproxy

Yep, we used fwknop for several years at work, back when it was written in perl. And now we use Wireguard.

That’s cute. Have Claude do it. There is already an echo system of TOPT QR to communicate it, so you would just need to convert your six digit code to two or more hits on the 16bit port range.

I’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.

Reply on news.ycombinator.com