Port Knocking (fwknop) for Fedora 13, 14

Greatings All,

This tutorial is and How to Guide for "Port Knocking" using "FWKNOP" on Fedora 13 and 14 , courtesy of " Ubersec"

fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports both iptables on Linux systems and ipfw on FreeBSD and Mac OS X systems) and libpcap. SPA is essentially next generation port knocking.

Please download the following packages:

#yum install -y wget

#yum install openssh-server (If the server is not installed already)

#yum -y install system-config-services

#yum install setools-gui.i686 (To install SELinux if you don't have it already)

#yum -y install policycoreutils-gui.i686 (To install SELinux Management if you don't have it already)

#yum install -y nmap (installing network mapper)

#yum -y install perl-HTML-Entities-Numbered.noarch

#yum -y install perl-HTML-Parser.i686

#yum -y install perl-SOAP-Lite.noarch

#yum -y install perl-ExtUtils-AutoInstall.noarch

Download perlmod from the following website http://sourceforge.net/projects/perlmod/

#perlmod -i IPC::Shareable

#yum install fwknop (Install the port-knocking service)

Disable SELINUX and establish successful SSH session.

Check if SELINUX is running by typing: # sestatus –v | less OR type the following to see if SELinux is disabled on your PC #/usr/sbin/getenforce

If SELinux is enabled please disable it on your system through the GUI by going to System --> Administration --> SELinux Administratoin and restart your PC.

Type the following command to start SSHD server #service sshd stop && service sshd start

TIP:

Also go through the GUI to services and assure that you enable SSH to start next startup.

Type the following command to check your ssh session #ssh localhost

Now type #nmap -p 22 Check to see if port 22 is

open.

TIP:

It should return open. If not your sshd service is not running.

For Example:

[root@ittlabusr fwknop]# nmap -p 22 localhost

Starting Nmap 5.21 ( http://nmap.org ) at 2011-04-08 12:23 EDT

Nmap scan report for localhost (127.0.0.1)

Host is up (0.00019s latency).

rDNS record for 127.0.0.1: localhost.localdomain

PORT STATE SERVICE

22/tcp open ssh

Configure IPTABLES

#sudo iptables-save -c > /etc/iptables-save

#cat /etc/iptables-save | sudo iptables-restore –c

Type #ifconfig to find out which interface you Linux is listening on. You will need to add it to the firewall.sh script below.

Now create the following file firewall.sh and add the followings:

#!/bin/sh

IPTABLES=/sbin/iptables

$IPTABLES -F

$IPTABLES -F -t nat

$IPTABLES -X

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/24 -o -j MASQUERADE

$IPTABLES -A INPUT -j LOG --log-prefix "DROP "

$IPTABLES -A INPUT -j DROP

$IPTABLES -A INPUT -p tcp --syn --dport 22 -j LOG --log-prefix "SSH SYN "

$IPTABLES -A INPUT -p tcp --syn --dport 22 -j LOG --log-prefix "DROP "

$IPTABLES -A FORWARD -j LOG --log-prefix "DROP "

$IPTABLES -A FORWARD -j DROP

echo 1 > /proc/sys/net/ipv4/ip_forward

echo "[+] EnGarde Secure Linux iptables policy activated"

exit

Save the file and then change the permission to execute: chmod +x firewall.sh

Now run it by typing #./firewall.sh

Now type #iptables -L to check that your iptables contain the new rules.

For Example,

It should show the followings:

[root@ittlabusr ~]# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

LOG all -- anywhere anywhere LOG level warning prefix `DROP '

DROP all -- anywhere anywhere

LOG tcp -- anywhere anywhere tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN LOG level warning prefix `SSH SYN '

LOG tcp -- anywhere anywhere tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN LOG level warning prefix `DROP '

Chain FORWARD (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

LOG all -- anywhere anywhere LOG level warning prefix `DROP '

DROP all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

Now type the following command to assure that you save the rules in IPTABLES #/sbin/iptables-save > /etc/sysconfig/iptables

Now restart your computer by typing #shutdown –r now

Now run nmap again to assure that IPTAB

For example,

#nmap -p 22 Check to see if port 22 is filtered

[root@ittlabusr fwknop]# nmap -p 22 localhost

Starting Nmap 5.21 ( http://nmap.org ) at 2011-04-08 12:25 EDT

Nmap scan report for localhost (127.0.0.1)

Host is up.

rDNS record for 127.0.0.1: localhost.localdomain

PORT STATE SERVICE

22/tcp filtered ssh

Nmap done: 1 IP address (1 host up) scanned in 2.10 seconds

Setup and configuring fwknop port-knocking application.

#gedit or nano /etc/fwknop/fwknop.conf

Change the line #ALERTING_METHODS ALL; (TO) --> ALERTING_METHODS noemail;

Change the line #shCmd /bin/sh; (TO) --> shCmd /bin/bash;

Change the line PCAP_INTF eth1; to assure that you are set to the correct interface!!!!!

TIP

Type ifconfig /all in another terminal to check your current interface.

Change the line #ENABLE_SPA_PACKET_AGING Y; (TO) --> ENABLE_SPA_PACKET_AGING N;

#gedit or nano /etc/fwknop/access.conf

Change the line #KEY: __CHANGEME__; to KEY: whatever you want; (The key must be 8 characters long at the least)

Add the line DATA_COLLECT_MODE: PCAP;

Unmark or add the line FW_ACCESS_TIMEOUT: 30; (time is in sec)

Stop and start fwknop service

#service fwknop stop

#service fwknop start

#netstat -anlp | grep fwknop (to check if fwknop is listening)

unix 2 [ ACC ] STREAM LISTENING 42445 7317/perl /var/run/fwknop/knoptm_ip_timeout.sock

OR

#service fwknop status

knoptm (pid 7317) is running...

fwknopd (pid 7314) is running...

knopwatchd (pid 7319) is running...

On the server side type the following to see logs coming in:

#tail -f /var/log/messages

On the other Linux client side type:

#fwknop -A -a -D

For example,

#fwknop -A tcp/22 -a 127.0.0.1 -D 10.75.3.232

OR

Download fwknop for Windows from

http://www.cipherdyne.org/fwknop/download/ and run fwknop for windows