be29a34732
Single Packet Authorization (SPA). fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports both iptables on Linux systems and ipfw on FreeBSD and Mac OS X systems) and libpcap. SPA requires only a single encrypted packet in order to communicate various pieces of information including desired access through an iptables policy and/or complete commands to execute on the target system. By using iptables to maintain a "default drop" stance, the main application of this program is to protect services such as OpenSSH with an additional layer of security in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) much more difficult. With fwknop deployed, anyone using nmap to look for sshd can't even tell that it is listening; it makes no difference if they have a 0-day exploit or not. The authorization server passively monitors authorization packets via libcap and hence there is no "server" to which to connect in the traditional sense. Access to a protected service is only granted after a valid encrypted and non-replayed packet is monitored from an fwknop client (see the following network diagram; the SSH session can only take place after the SPA packet is monitored): PR: ports/118229 Submitted by: Sean Greven <sean.greven@gmail.com>
45 lines
1.9 KiB
Text
45 lines
1.9 KiB
Text
--- fwknop.conf.orig 2007-11-23 22:37:27.000000000 +0200
|
|
+++ fwknop.conf 2007-11-23 22:40:56.000000000 +0200
|
|
@@ -10,7 +10,7 @@
|
|
#
|
|
# Note there are no access control directives in this file. All access
|
|
# control directives are located in the file
|
|
-# /etc/fwknop/access.conf. You will need to edit the access.conf file in
|
|
+# %%PREFIX%%/etc/fwknop/access.conf. You will need to edit the access.conf file in
|
|
# order for fwknop to function correctly.
|
|
#
|
|
#############################################################################
|
|
@@ -90,7 +90,7 @@
|
|
|
|
### If GPG keys are used instead of a Rijndael symmetric key, this is
|
|
### the default GPG keys directory. Note that each access block in
|
|
-### /etc/fwknop/access.conf can specify its own GPG directory to override
|
|
+### %%PREFIX%%/etc/fwknop/access.conf can specify its own GPG directory to override
|
|
### this default.
|
|
GPG_DEFAULT_HOME_DIR /root/.gnupg;
|
|
|
|
@@ -184,8 +184,8 @@
|
|
FWKNOP_DIR /var/log/fwknop;
|
|
FWKNOP_RUN_DIR /var/run/fwknop;
|
|
FWKNOP_LIB_DIR /var/lib/fwknop; # for legacy port knocking mode
|
|
-FWKNOP_MOD_DIR /usr/lib/fwknop;
|
|
-FWKNOP_CONF_DIR /etc/fwknop;
|
|
+FWKNOP_MOD_DIR %%PREFIX%%/lib/fwknop;
|
|
+FWKNOP_CONF_DIR %%PREFIX%%/etc/fwknop;
|
|
FWKNOP_ERR_DIR $FWKNOP_DIR/errs;
|
|
|
|
### Files
|
|
@@ -216,8 +216,8 @@
|
|
mknodCmd /bin/mknod;
|
|
iptablesCmd /sbin/iptables;
|
|
ipfwCmd /sbin/ipfw; ### BSD and Mac OS X only
|
|
-fwknopdCmd /usr/sbin/fwknopd;
|
|
-fwknop_servCmd /usr/sbin/fwknop_serv;
|
|
-knopmdCmd /usr/sbin/knopmd;
|
|
-knoptmCmd /usr/sbin/knoptm;
|
|
-knopwatchdCmd /usr/sbin/knopwatchd;
|
|
+fwknopdCmd %%PREFIX%%/sbin/fwknopd;
|
|
+fwknop_servCmd %%PREFIX%%/sbin/fwknop_serv;
|
|
+knopmdCmd %%PREFIX%%/sbin/knopmd;
|
|
+knoptmCmd %%PREFIX%%/sbin/knoptm;
|
|
+knopwatchdCmd %%PREFIX%%/sbin/knopwatchd;
|