FWKNOPD(8) Fwknop Server FWKNOPD(8) (NAME) fwknopd - (Firewall Knock Operator) (SYNOPSIS) fwknopd [] (DESCRIPTION) fwknopd FireWall Knock Operator (Single Packet Authorization SPA) fwknop SPA ( ) ACL . SSH ( ) . Nmap Shodan . fwknopd : fwknopd.conf access.conf. ( /etc/fwknop). . "Single Packet Authorization: A Comprehensive Guide to Strong Service Concealment with fwknop" (: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html). (COMMAND-LINE OPTIONS) -i, --interface=<> "-i eth0". "PCAP_INTF" fwknopd.conf . -f, --foreground fwknopd . (stderr) . / . --fw-list fwknopd . -a, --access-file=<-> access.conf. fwknopd ( /etc/fwknop/access.conf) . --access-folder=<-> access.conf. access.conf .conf . -c, --config=<-> fwknopd.conf. fwknopd ( /etc/fwknop/fwknopd.conf) . -C, --packet-limit=<> SPA . -d, --digest-file=<-> digest.cache. fwknopd ( /var/fwknop/digest.cache) . -D, --dump-config fwknopd /etc/fwknop/fwknopd.conf ( ) /etc/fwknop/access.conf (stderr). --dump-serv-err-codes fwknopd (stdout) . . --fault-injection-tag=<> (fault injection) fwknop libfiu (: http://blitiri.com.ar/p/libfiu). fwknop . . -A, --afl-fuzzing fwknopd SPA (stdin) American Fuzzy Lop (AFL) Michal Zalewski. fwknop --enable-afl-fuzzing configure / AFL . AFL SPA libfko . --fw-list-all fwknopd . --fw-flush (flush) fwknopd. fwknopd . -K, --kill fwknopd. fwknopd . --exit-parse-config (/etc/fwknop/fwknopd.conf /etc/fwknop/access.conf) . . --exit-parse-digest-cache /var/fwknop/digest.cache . . . -l, --locale=<> ( ) . --no-ipt-check-support -C iptables. iptables -C . -O, --override-config=<> /etc/fwknop/fwknopd.conf . . --key-gen fwknopd Rijndael HMAC SPA . /dev/urandom base64 (stanza) /etc/fwknop/access.conf . . --key-gen-file=<> . . --key-gen . --key-len=<> Rijndael. . --hmac-key-len=<> HMAC. . -p, --pid-file=<-pid> fwknopd.pid. fwknopd ( /var/fwknop/fwknopd.pid) . -P, --pcap-filter=<> (BPF) fwknopd. PCAP_FILTER /etc/fwknop/fwknopd.conf . --pcap-file=<-pcap> fwknopd pcap . SPA /etc/fwknop/fwknopd.conf . --pcap-any-direction fwknopd SPA . SPA (forward) . (egress) ( SPA ) fwknopd . . (promiscuous mode) . -R, --restart fwknopd. fwknopd fwknopd fwknopd.conf /etc/fwknop/access.conf . () "FWKNOP" iptables . --rotate-digest-cache (rotate) "-old" . /var/fwknop/digest.cache . -r, --run-dir=<> fwknopd . /var . -S, --status fwknopd . fwknopd . --syslog-enable syslog . -t, --test fwknopd . fwknopd SPA SPA . . -U, --udp-server fwknopd UDP SPA UDP libpcap . "ENABLE_UDP_SERVER" . -v, --verbose fwknopd (verbose). ( ) . -h, --help . -V, --Version . FWKNOPD (FWKNOPD CONFIG AND ACCESS VARIABLES) fwknopd ( ) /etc/fwknop/fwknopd.conf . fwknopd.conf . /etc/fwknop/access.conf . fwknop SPA . FWKNOPD.CONF (FWKNOPD.CONF VARIABLES) fwknopd . . /etc/fwknop/fwknopd.conf . PCAP_INTF <> fwknopd . ENABLE_PCAP_PROMISC fwknopd pcap (promiscuous) . ( ) "N" . PCAP_FILTER < pcap> PCAP fwknopd UDP . fwknop --rand-port SPA "udp dst portrange 10000-65535" . ENABLE_SPA_PACKET_AGING fwknopd SPA . "" "MAX_SPA_PACKET_AGE" . "ENABLE_SPA_PACKET_AGING" "N" fwknopd . MAX_SPA_PACKET_AGE <> ( ) SPA . fwknopd (NTP ). ( ) . ENABLE_DIGEST_PERSISTENCE (digest) SPA fwknopd . fwknopd . "Y" . "N" fwknopd SPA . (replay attack) . RULES_CHECK_THRESHOLD <> (deep check) . fwknopd exp<> fwknopd . . . ENABLE_IPT_FORWARDING SPA iptables ( FWKNOP_FORWARD INPUT). ENABLE_IPT_LOCAL_NAT SPA NAT. ACCEPT FWKNOP_INPUT DNAT . "ssh -p " ( --NAT-local --NAT-rand-port fwknop ). ENABLE_IPT_SNAT "Y" SNAT. ( "ENABLE_IPT_FORWARDING" ) fwknopd DNAT SNAT . SNAT IP fwknopd . SNAT_TRANSLATE_IP <_IP> IP SNAT. "ENABLE_IPT_SNAT" "Y" SNAT MASQUERADE ( IP /etc/fwknop/fwknopd.conf ) fwknopd SNAT IP "SNAT_TRANSLATE_IP" . "FORCE_SNAT" /etc/fwknop/access.conf IP . ENABLE_IPT_OUTPUT ACCEPT FWKNOP_OUTPUT. (state tracking) OUTPUT drop . MAX_SNIFF_BYTES <> . . FLUSH_IPT_AT_INIT (flush) fwknop fwknopd. "Y" . FLUSH_IPT_AT_EXIT fwknop fwknopd . "Y" . EXIT_AT_INTF_DOWN fwknopd (down) fwknopd systemd upstart . fwknopd systemd upstart "EXIT_AT_INTF_DOWN" . fwknopd . ENABLE_RULE_PREPEND iptables firewalld fwknopd SPA ( "FWKNOP_INPUT") . . ENABLE_NAT_DNS fwknopd (hostnames) NAT. GPG_HOME_DIR <> Rijndael GPG GPG . /etc/fwknop/access.conf GPG . access.conf $HOME/.gnupg fwknopd ( root) . GPG_EXE <> GPG /usr/bin/gpg . LOCALE <> ( LC_ALL). . ENABLE_SPA_OVER_HTTP fwknopd SPA HTTP ( fwknop --HTTP). "PCAP_FILTER" TCP/80 fwknopd . ENABLE_X_FORWARDED_FOR fwknopd X-Forwarded-for SPA HTTP IP . SPA HTTP . ENABLE_TCP_SERVER TCP fwknopd. TCP <<>> TCP TCPSERV_PORT . "Y" fwknopd TCP . . SPA TCP PCAP . . fwknopd pcap PCAP_FILTER TCP . TCPSERV_PORT <> TCP <<>> . "ENABLE_TCP_SERVER" "Y" . ENABLE_UDP_SERVER UDP fwknopd. fwknopd SPA UDP libpcap . fwknop --enable-udp-server ( configure) libpcap . UDP fwknopd (ACK) SPA . UDPSERV_PORT <> UDP . "ENABLE_UDP_SERVER" "Y" . PCAP_DISPATCH_COUNT <> pcap_dispatch() . fwknopd SPA . fwknopd libpcap . pcap_dispatch(3) . PCAP_LOOP_SLEEP <> usleep() pcap . . ENABLE_PCAP_ANY_DIRECTION fwknopd SPA . SPA . fwknopd "Y" . "N" fwknopd SPA ( ). SYSLOG_IDENTITY <> syslog fwknopd. . SYSLOG_FACILITY <> (facility) syslog. "SYSLOG_FACILITY" . ENABLE_DESTINATION_RULE fwknopd (destination) SPA . IP . "ENABLE_IPT_OUTPUT" "Y" . FORWARD SNAT DNAT . "N" 0.0.0.0/0 ( ) . FWKNOP_RUN_DIR <> fwknopd . /var . ACCESS.CONF (ACCESS.CONF VARIABLES) /etc/fwknop/access.conf . fwknop SPA . access.conf SPA IP ( ) "SOURCE" . "SOURCE" (stanza) . "SOURCE" . SOURCE SPA . "ANY" SPA IP . /etc/fwknop/access.conf "SOURCE" . CIDR ( "192.168.10.0/24") IP . IP / ( "192.168.10.0/24,10.1.1.123"). DESTINATION SPA . "ANY" SPA IP . CIDR ( "192.168.10.0/24") IP . IP / ( "192.168.10.0/24,10.1.1.123"). OPEN_PORTS ,..., (tcp udp) (knock sequence) . fwknopd / SPA ( "RESTRICT_PORTS" ). . RESTRICT_PORTS ,..., (tcp udp) SPA . . KEY <> SPA fwknop Rijndael . PBKDF1 . SPA GnuPG ( GPG ). KEY_BASE64 < base64> KEY base64 . (non-ascii) base64 . HMAC_KEY <> HMAC SPA. Rijndael GPG << >> . HMAC_KEY_BASE64 < base64> HMAC base64. base64 . FW_ACCESS_TIMEOUT <> IP fwknopd . "FW_ACCESS_TIMEOUT" . %include <> fwknopd (import) access.conf . SPA . /etc/fwknop/access.conf . %include_folder <> %include %include_folder fwknopd .conf . access-folder . ENCRYPTION_MODE <> AES. CBC OFB CFB . . "legacy" SPA (IV) fwknop 2.5 . 2.5 fwknop PBKDF1 . HMAC_DIGEST_TYPE < > (digest) SPA . MD5 SHA1 SHA256 SHA384 SHA512 SHA3_256 SHA3_512 . fwknopd HMAC SHA256 . ACCESS_EXPIRE MM/DD/YYYY . SPA . . ACCESS_EXPIRE_EPOCH <> (epoch time) ACCESS_EXPIRE . SPA . . ENABLE_CMD_EXEC fwknopd . fwknopd "CMD_EXEC_USER" fwknopd ( ). ENABLE_CMD_SUDO_EXEC sudo "sudoers" . ( "ENABLE_CMD_EXEC") SPA "/path/to/sudo -u -g " sudo "SUDO_EXE" "" "CMD_SUDO_EXEC_USER" ( "root" ) "" "CMD_SUDO_EXEC_GROUP" ( "root" ). CMD_EXEC_USER <> ( setuid) SPA . fwknopd ( root) . "nobody" . CMD_SUDO_EXEC_USER <> ( "sudo -u ") SPA . fwknopd root . CMD_EXEC_GROUP <> ( setgid) SPA . fwknopd ( root) . "nobody" . CMD_SUDO_EXEC_GROUP <> ( "sudo -g ") SPA . fwknopd root . CMD_CYCLE_OPEN <> / SPA. "CMD_CYCLE_CLOSE" . fwknopd ACL iptables . ACL . "CMD_CYCLE_OPEN" "CMD_CYCLE_CLOSE" (payload) SPA . "$" "$IP" ( IP SPA) "$SRC" ( "$IP") "$PKT_SRC" ( IP SPA) "$DST" ( IP ) "$PORT" ( ) "$PROTO" ( ) "$TIMEOUT" ( ) . CMD_CYCLE_CLOSE <> "CMD_CYCLE_OPEN" . "$IP" "$PORT" "$PROTO" . "NONE" . . CMD_CYCLE_TIMER <> "CMD_CYCLE_CLOSE" . / . SUDO_EXE <> sudo . "/usr/bin/sudo" . REQUIRE_USERNAME <> SPA . SPA . REQUIRE_SOURCE_ADDRESS SPA IP . -s fwknop -R ( NAT ) IP -a . REQUIRE_SOURCE_ADDRESS "REQUIRE_SOURCE_ADDRESS". FORCE_NAT SPA NAT IP ( ) . SSHD access.conf . SPA . FORCE_SNAT SPA SNAT DNAT ( ) FORCE_NAT . "SNAT_TRANSLATE_IP" /etc/fwknop/fwknopd.conf "SNAT_TRANSLATE_IP" . NAT ( SPA SPA ). FORCE_MASQUERADE "FORCE_SNAT" IP SNAT MASQUERADE . FORWARD_ALL NAT fwknopd fwknop . DISABLE_DNAT FORCE_NAT DNAT . FORWARD_ALL fwknopd (gateway) SPA fwknop SPA IP DHCP SPA . GPG_DECRYPT_ID <_> GnuPG SPA fwknop . GPG . GPG fwknopd . GPG fwknopd GPG fwknop . /etc/fwknop/access.conf fwknopd ( SPA ). fwknop GnuPG : "http://www.cipherdyne.org/fwknop/docs/gpghowto.html". GPG_DECRYPT_PW <_> gpg "GPG_DECRYPT_ID" . gpg . GPG_ALLOW_NO_PW fwknopd GnuPG . "http://www.gnupg.org/faq/GnuPG-FAQ.html#how-can-i-use-gnupg-in-an-automated-environment": << >>. GnuPG libgpgme gpg-agent / pinentry . GPG_REQUIRE_SIG Y fwknopd SPA GPG ( ) . . Y . GPG_DISABLE_SIG SPA. N . GPG_IGNORE_SIG_VERIFY_ERROR fwknopd GPG ( ) . GPG_REQUIRE_SIG Y . GPG_REMOTE_ID <_,...,_> gpg SPA fwknopd . . "GPG_DISABLE_SIG" Y ( ). . GPG_FINGERPRINT_ID <_,...,_> (fingerprints) GnuPG "GPG_REMOTE_ID" . fwknop : 00CC95F05BC146B6AC4038C9E36F443C6A3FAD56. GPG_HOME_DIR <> GnuPG fwknopd. /etc/fwknop/access.conf fwknopd /root/.gnupg () SPA access.conf . GPG_EXE <> GnuPG. /etc/fwknop/access.conf fwknopd /usr/bin/gpg . (FILES) /etc/fwknop/fwknopd.conf fwknop. /etc/fwknop/access.conf . (DEPENDENCIES) fwknopd libfko fwknop . fwknopd libpcap ( ) . GPG GnuPG libgpgme . / fwknopd iptables ipfw pf . (DIAGNOSTICS) fwknopd -f, --foreground -v, --verbose . (stderr) . fwknopd test-fwknop.pl test/ fwknop . fwknop valgrind SPA HMAC OpenSSL SPA . (SEE ALSO) fwknopd(8), iptables(8), pf(4), pfctl(8), ipfw(8), gpg(1), libfko documentation. "Single Packet Authorization with fwknop" http://www.cipherdyne.org/fwknop/docs/SPA.html . fwknop http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html . fwknop fwknop SPA . fwknop git Github : $ git clone https://github.com/mrash/fwknop.git fwknop.git Michael Rash : http://twitter.com/michaelrash, @michaelrash (AUTHORS) fwknop Michael Rash ( ) Damien Stuart Jonathan Bennett . (CONTRIBUTORS) C fwknop Perl . CREDITS fwknop https://github.com/mrash/fwknop/blob/master/CREDITS . : Franck Joncourt Max Kastanas Vlad Glagolev Sean Greven Hank Leininger Fernando Arnaboldi Erik Gomez. "Single Packet Authorization" MadHat Simple Nomad BlackHat Briefings . (BUGS) dstuart@dstuart.org mbr@cipherdyne.org (issue) (: https://github.com/mrash/fwknop.git). . fwknop (: https://lists.sourceforge.net/lists/listinfo/fwknop-discuss). (DISTRIBUTION) fwknopd (GNU General Public License GPL v2+) http://www.cipherdyne.org . Fwknop Server 08/06/2018 FWKNOPD(8)