2

By robust and low-hassle I mean NOT involving complex iptables setups, NOT involving apache, NOT requiring an additional client program, NOT requiring fragile shell scripts running from cron, etc.

Does anybody have sshd & ssh (client) patches to enable some form of port-knocking built-in to the sshd service & client itself?

For instance, rejecting connections on Port 22 until a properly encrypted and verified UDP packet is received, would be nice.

I'm disappointed that all port-knocking solutions out there are shameless hacks, rather than a nicely integrated and tested patch to the programs in question.

6

knockd seems to be one of the more established implementations, although doesn't fit your criteria of being a patch to sshd itself. Personally I'd favour an external program for reasons including:

  • it can be used to help secure other services (e.g. IMAP, OpenVPN) as well as ssh
  • patching extra functionality into sshd increases likelihood of introducing vulnerabilities (no matter how "tested" such a patch may be, sshd runs as root so the smallest flaw could prove to be quite nasty)
| improve this answer | |
  • 3
    +1 for not patching core system daemons and keeping separate functionality... well, separate. – womble Nov 22 '09 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.