FWKNOP(8) Fwknop Client FWKNOP(8) (NAME) fwknop - (Firewall Knock Operator) (SYNOPSIS) fwknop -A <'proto/ports'> -R|-a|-s -D <'host'> [] (DESCRIPTION) fwknop << >> (Single Packet Authorization SPA) . SPA (non-replayable) HMAC (default-drop) . SPA SSH ( ) . SPA Nmap . fwknop : iptables firewalld PF ipfw OpenBSD FreeBSD Mac OS X. fwknop ipset nftables . SPA (Port Knocking PK) PK . PK : (replay attacks) HMAC (DoS) PK PK ( PK ). SPA . SPA default-drop SPA (passive) ( libpcap ) SPA / . fwknop SPA . fwknopd SPA (sniff) SPA . fwknopd(8) . <> (: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html). SPA fwknop HMAC << >> (encrypt-then-authenticate) . HMAC ( --use-hmac ) : ) HMAC fwknop GnuPG HMAC ) HMAC CBC ( Vaudenay "Lucky 13" SSL) ) fwknopd HMAC SPA SPA HMAC . ) GnuPG HMAC SPA HMAC libgpgme . GnuPG libgpgme HMAC . HMAC SPA --key-gen . fwknop SPA Rijndael GnuPG . ( /etc/fwknop/access.conf fwknopd ). Rijndael PBKDF1 CBC . GnuPG GnuPG . SPA fwknop ( HMAC) : random data (16 digits) [ ] username [ ] timestamp [ ] software version [ ] mode [: () ()] if command mode => command to execute [ => ] else access mode => IP,proto,port [ => IP,proto,port] message digest (SHA512 / SHA384 / SHA256 / SHA1 / MD5 / SHA3_256 / SHA3_512) [ ] ":" ":" base64 . ( SHA256) HMAC SPA . ( ) SPA PBKDF1 Rijndael CBC ( ) . fwknopd SHA256 SPA fwknop . Syslog . fwknop UDP 62201 --server-port ( fwknopd SPA ). fwknop SPA --rand-port . fwknopd(8) . fwknop (EXAMPLES) . fwknop (portable) ( OpenWRT) FreeBSD OpenBSD Mac OS X Cygwin . libfko fwknop fwknopd / SPA HMAC . SPA (GPL v2+) . (REQUIRED ARGUMENTS) ~/.fwknoprc ( -n, --named-config << FWKNOPRC>> ). -A, --access= fwknopd . "+/.../+" "tcp/22,udp/53". : fwknop -A --server-cmd SPA fwknopd . -D, --destination= fwknop / fwknopd IP . / fwknopd . -R|-a|-s ( ) fwknopd IP . -R -a -s SPA (MITM) REQUIRE_SOURCE_ADDRESS /etc/fwknop/access.conf . -a fwknop HTTPS https://www.cipherdyne.org/cgi-bin/myip IP . -a IP fwknop . (GENERAL OPTIONS) -h, --help . -G, --get-key= / . IP (":") . . : . fwknop (prompt) . rc fwknop . --stdin / (stdin). (pipe) . --fd 0 . --fd= / . (stanza) . stdin . --get-hmac-key= / HMAC . --get-key HMAC IP (":") . . : . HMAC fwknop . rc fwknop . --key-gen fwknop Rijndael HMAC SPA . /dev/urandom base64 "$HOME/.fwknoprc" ( --get-key) . . --key-gen-file= . . --key-gen . --key-len= Rijndael. . --hmac-key-len= HMAC. . -l, --last-cmd fwknop ( ). ~/.fwknop.run . -n, --named-config= "$HOME/.fwknoprc" . fwknop . .fwknoprc << FWKNOPRC>> . --key-rijndael= Rijndael . ps . fwknop "$HOME/.fwknoprc" . --key-base64-rijndael= base64 Rijndael. ps . "$HOME/.fwknoprc" . --key-base64-hmac= base64 HMAC. ps . --key-hmac= HMAC ( base64). ps . --rc-file= rc fwknop ( "$HOME/.fwknoprc" ). --no-rc-file fwknop "$HOME/.fwknoprc". --no-home-dir fwknop . --save-rc-stanza= "$HOME/.fwknoprc" -n. -n ( IP) -D . --force-stanza --save-rc-stanza . --stanza-list "$HOME/.fwknoprc". --show-last fwknop. -E, --save-args-file= . --no-save-args ~/.fwknop.run . --no-save-args fwknop . -T, --test . SPA . SPA . . -B, --save-packet= fwknop SPA . -b, --save-packet-append -B. --fault-injection-tag= fwknop libfiu (: http://blitiri.com.ar/p/libfiu/). fwknop . . -v, --verbose fwknop (verbose). fwknop SPA . -V, --version . SPA (SPA OPTIONS) --use-hmac HMAC SPA. fwknop 2.5 . -a, --allow-ip= IP fwknopd ( IP SPA ). (MITM) SPA IP . fwknopd IP SPA . -a SPA . -a IP SPA --spoof-src . -R ( ) fwknop IP https://www.cipherdyne.org/cgi-bin/myip . IP . -g, --gpg-encryption GPG SPA ( Rijndael ). : GPG ( --gpg-recipient GPG ). --hmac-digest-type= HMAC SPA. : MD5 SHA1 SHA256 () SHA384 SHA512 SHA3_256 SHA3_512. -N, --nat-access= fwknopd SPA iptables NAT iptables . fwknopd RFC-1918 fwknop IP "+--NAT-access 192.168.10.2,55000+". 192.168.10.2 55000 --access ( tcp/22) . SPA "ssh -p 55000 user@host" 192.168.10.2 . "55000" --nat-rand-port ( ) . --nat-local fwknopd NAT . iptables 55000 22 . --nat-local fwknop . SPA 55000 22. --nat-port fwknop tcp/22 fwknopd . --nat-port ( tcp/22) ( -p SSH ). --nat-local --nat-access fwknop NAT . --nat-rand-port fwknop tcp/22 fwknopd . --nat-rand-port ( tcp/22) . fwknop fwknop . SSH -p . --nat-local --nat-access . -p, --server-port= fwknopd libpcap ulogd pcap writer . fwknopd UDP 62201 . -P, --server-proto= (udp tcp http udpraw tcpraw icmp) SPA. : udpraw tcpraw icmp (raw sockets) (root) . : tcp SPA TCP . Tor : http://tor.eff.org/. fwknopd TCP ( 62201 ) . -Q, --spoof-src= fwknop SPA . root . --spoof-user REQUIRE_USERNAME /etc/fwknop/access.conf . -r, --rand-port fwknop SPA 10000 65535. fwknopd PCAP_FILTER . PCAP_FILTER : "+udp dst portrange 10000-65535+". -R, --resolve-ip-https fwknop HTTPS cipherdyne.org IP ( ) . IP fwknopd . fwknop NAT IP . : https://www.cipherdyne.org/cgi-bin/myip fwknop wget --secure-protocol . IP -a fwknop HTTPS . --resolve-url URL IP . URL IP HTTP . --resolve-http-only fwknop IP HTTP HTTPS . wget ( SSL ) MITM HTTP IP . IP -a -R . -w, --wget-cmd= wget. configure wget . -s, --source-ip fwknop SPA IP "+0.0.0.0+" SPA fwknopd IP SPA IP . fwknop NAT IP . -a -R . -s -R -a (mutually exclusive) . -S, --source-port= SPA. --server-resolve-ipv4 fwknop SPA IPv4 DNS . DNS IPv6 IPv4 . -f, --fw-timeout= ( ) . fwknopd (connection tracking) . -C, --server-cmd= SPA --server-cmd fwknopd . SPA fwknopd . -H, --http-proxy=[:port] HTTP fwknop SPA . SPA ( --server-proto ) "http" . ":" IP . -m, --digest-type= SPA. : MD5 SHA1 SHA256 () SHA384 SHA512 SHA3_256 SHA3_512. -M, --encryption-mode= AES SPA . CBC CFB OFB /etc/fwknop/access.conf ENCRYPTION_MODE . (CBC) . "legacy" SPA fwknop 2.5 . 2.5 fwknop OpenSSL PBKDF1 . --time-offset-plus=