3

Does anyone know how to get Port Knocking work on macOS Sierra. I couldn't find any useful information after a search.

It works now, thanks for all the help. @klanomath @jksoegaard. Wish you all the best.

Here are the configurations:

  1. Configuration: /usr/local/etc/ssh-access.txt is empty initially

  2. Configuration: /etc/pf.conf

    scrub-anchor "com.apple/*"
    nat-anchor "com.apple/*"
    rdr-anchor "com.apple/*"
    dummynet-anchor "com.apple/*"
    anchor "com.apple/*"
    load anchor "com.apple" from "/etc/pf.anchors/com.apple"
    table <ssh-access> persist file "/usr/local/etc/ssh-access.txt"
    pass in quick proto tcp from <ssh-access> to port 22
    
  3. Configuration: /usr/local/etc/knockd.conf

    [options]
            logfile = /var/log/knockd.log
    [openSSH]
            sequence    = 7000,8000,9000
            seq_timeout = 5
            command     = echo %IP% > /usr/local/etc/ssh-access.txt
            tcpflags    = syn
    [commitFW]
            sequence    = 9000,8000,7000
            seq_timeout = 5
            command     = pfctl -t ssh-access -T replace -f /usr/local/etc/ssh-access.txt
            tcpflags    = syn
    [closeSSH]
            sequence    = 5000,4000,6000
            seq_timeout = 5
            command     = echo '' > /usr/local/etc/ssh-access.txt
            tcpflags    = syn
    
  4. Output when Launch knockd:

    config: new section: 'options'
    config: log file: /var/log/knockd.log
    config: new section: 'openSSH'
    config: openSSH: sequence: 7000:tcp,8000:tcp,9000:tcp
    config: openSSH: seq_timeout: 5
    config: openSSH: start_command: echo %IP% > /usr/local/etc/ssh-access.txt
    config: tcp flag: SYN
    config: new section: 'commitFW'
    config: commitFW: sequence: 9000:tcp,8000:tcp,7000:tcp
    config: commitFW: seq_timeout: 5
    config: commitFW: start_command: pfctl -t ssh-access -T replace -f /usr/local/etc/ssh-access.txt
    config: tcp flag: SYN
    config: new section: 'closeSSH'
    config: closeSSH: sequence: 5000:tcp,4000:tcp,6000:tcp
    config: closeSSH: seq_timeout: 5
    config: closeSSH: start_command: echo '' > /usr/local/etc/ssh-access.txt
    config: tcp flag: SYN
    ethernet interface detected
    Local IP: 192.168.8.101
    Adding pcap expression for door 'openSSH': (dst host 192.168.8.101 and (((tcp dst port 7000 or 8000 or 9000) and tcp[tcpflags] & tcp-syn != 0)))
    Adding pcap expression for door 'commitFW': (dst host 192.168.8.101 and (((tcp dst port 9000 or 8000 or 7000) and tcp[tcpflags] & tcp-syn != 0)))
    Adding pcap expression for door 'closeSSH': (dst host 192.168.8.101 and (((tcp dst port 5000 or 4000 or 6000) and tcp[tcpflags] & tcp-syn != 0)))
    
  5. Knock from client Mac

    192:~ vincent-st$ knock -v 192.168.8.101 7000,8000,9000
    hitting tcp 192.168.8.101:7000
    192:~ vincent-st$ knock -v 192.168.8.101 9000,8000,7000
    hitting tcp 192.168.8.101:9000
    192:~ vincent-st$ ssh vincent-st@192.168.8.101
    ssh: connect to host  port 22: connection refused
    

After using the proper knock command ssh works:

  1. Knock from client Mac

    192:~ vincent-st$ knock -v 192.168.8.101 7000 8000 9000
    hitting tcp 192.168.8.101:7000
    hitting tcp 192.168.8.101:8000
    hitting tcp 192.168.8.101:9000
    
    192:~ vincent-st$ knock -v 192.168.8.101 9000 8000 7000
    hitting tcp 192.168.8.101:9000
    hitting tcp 192.168.8.101:8000
    hitting tcp 192.168.8.101:7000
    
    192:~ vincent-st$ ssh vincent-st@192.168.8.101
    The authenticity of host '192.168.8.101 (192.168.8.101)' can't be established.
    
    RSA key fingerprint is SHA256:6AlMpQmxODOueRS+faoODOueRS+ODOueRS+fa.
    Are you sure you want to continue connecting (yes/no)? yes
    Warning: Permanently added '192.168.8.101' (RSA) to the list of known hosts.
    
    Password:
    
    Last login: Tue Jul 11 01:14:56 2017 `
    
  • Slowly transforming a question into an answer in the question by editing the question repeatedly isn't very meaningful because the original problem gets lost. Usually it's better to write a 2nd answer mentioning all the hurdles, improper configs or errors you made etc (even so a proper answer is already posted). – klanomath Jul 10 '17 at 18:41
9

If you need to get port knocking working as a client (i.e. you want to access a remote service that is protected by port knocking) - then install the knock program from Homebrew like this:

brew install knock

You'll need to have Homebrew installed in advance.

Then you can use the program from Terminal.app like this:

knock myserver 1234 5678 9012

where the numbers are the ports to knock.

If you need to get port knocking working as a server (i.e. you want to protect a local resource so that remote access is limited to those in-the-know by port knocking) - then similarly install knock from Homebrew.

After installation you'll need to create a knockd.conf configuration customized to your requirements (i.e. which type of service you want to protect, the ports to use, etc.) - and finally start knockd using launchd.

You can find an example of how to do this here:

Example knockd setup

  • Thanks for all the inputs, sir. I did try this before asking for help. I have homebrew installed, and run brew install knock to install knock on my server. Then, I created an empty file: /usr/local/etc/ssh-access.txt, and edit the file /usr/local/etc/knockd.conf as the link suggests, then run the command: /usr/local/sbin/knockd -dDv -i en0 -c /usr/local/etc/knockd.conf. I still could ssh into the server without port knocking. – Vincent Sun Jul 9 '17 at 8:33
  • This is because you skipped the pf skip in the link in my post. You have to add to pf.conf (the firewall configuration) that access to port 22 (ssh) is only allowed to those listed in the ssh-access.txt file. This is the file that is updated by knockd. – jksoegaard Jul 9 '17 at 10:00
  • Yes, that's the part which confuses me. I have no idea how to add pf.conf which accesses to port 22 to the ssh-access.txt file. I tried to add the server IP and port to the /usr/local/etc/ssh-access.txt, but I'm not sure if it's correct. After all this was done. I tried to knock from the client Mac. Here is what it looks like (pictures are shows in the question). – Vincent Sun Jul 10 '17 at 2:01
  • Just follow the instructions in the link I gave you. It shows what to write in the pf.conf file. You should not manually add anything to ssh-access.txt - so just delete that file and recreate it empty as the instructions states. – jksoegaard Jul 10 '17 at 11:31
  • @jksoegaard latest package also needs /usr/local/sbin, in my case it was not created so I've created and given permissions. Could you expand answer?, this might be helpful for others. – Rafael Aguilar Mar 19 '18 at 12:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .