Well, there are different kinds of security

Well, there are different kinds of security

Posted Mar 6, 2007 10:05 UTC (Tue) by dion (subscriber, #2764)
In reply to: Bad Security by ldo
Parent article: Single Packet Authorization (Linux Journal)

ssh is what provides the real security, I don't think anyone wants to replace ssh with telnet and port knocking.

As far as I can tell the two arguments for port knocking are:

1) It's very likely that casual attackers (99.99% or more) cannot sniff your traffic, so it's still worth while to shut those down.

2) Port knocking can be implemented using very simple code that can be audited completely (a perl script reading the firewall log) and thus you can be sure that there are no dangerous holes in the implementation.

Moving actual crypto and package parsing into the solution (SPA) is a mistake IMHO, as that's simply moving too much complexity to trust.

If history has shown anything then it's that real security is hard (see ssh) and as a consequence of that people some times make mistakes, port knocking is a dead simple way of dramatically decreasing the chance that some script kiddie hits your server before you get around to patching it.

---

(Log in to post comments)