knock：端口敲門服務

端口敲門服務，即：knockd服務。該服務通過動態的添加iptables規則來隱藏系統開啟的服務，使用自定義的一系列序列號來“敲門”，使系統開啟需要訪問的服務端口，才能對外訪問。不使用時，再使用自定義的序列號來“關門”，將端口關閉，不對外監聽。進一步提升了服務和系統的安全性。

1 安裝knockd

apt install knockd

2 配置knockd服務

$ vim /etc/knockd.conf
[options]
        # UseSyslog
        LogFile = var/knock/knock.log

[openSSH]
        # 定義敲門暗號順序
        sequence    = 7000,8000,9000
        # 設置超時時間，時間太小可能會出錯
        seq_timeout = 30
        # 設置敲門成功后所執行的命令
　　　　 # 在ubuntu系統iptables規則默認是禁止所有的規則，如果直接添加規則默認是在drop all規則之后，因此需要先刪除drop all的規則再添加所要設置的規則，最后重新添加drop all的規則。
　　　　 # command = /sbin/iptables -D INPUT -p tcp --dport 22 -j DROP && /sbin/iptables -A INPUT -s [允許遠程的IP] -p tcp --dport 22 -j ACCEPT && /sbin/iptables -A INPUT -p tcp --dport 22 -j DROP
        command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
        tcpflags    = syn

[closeSSH]
        sequence    = 9000,8000,7000
        seq_timeout = 30
        command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
        tcpflags    = syn

[openHTTPS]
        sequence    = 12345,54321,24680,13579
        seq_timeout = 5
        command     = /usr/local/sbin/knock_add -i -c INPUT -p tcp -d 443 -f %IP%
        tcpflags    = syn

3 啟動knockd

systemctl start knockd

4 實例

1. 配置knock如下：

   $ cat /etc/knockd.conf 
   [options]
           UseSyslog
   
   [openSSH]
           sequence    = 1356, 6784, 3409
           seq_timeout = 5
           command     = /sbin/iptables -I INPUT 1 -s %IP% -p tcp --dport 22 -j ACCEPT
           tcpflags    = syn
   
   [closeSSH]
           sequence    = 3409, 6784, 1356
           seq_timeout = 5
           command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
           tcpflags    = syn
   

2. 查看測試系統的SSH端口開啟狀態

   ┌──(kali㉿kali)-[~]
   └─$ nmap -A -p 22 192.168.50.71 -oA djinn   
   Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-28 11:03 CST
   Nmap scan report for 192.168.50.71
   Host is up (0.00071s latency).
   
   PORT   STATE  SERVICE VERSION
   22/tcp closed ssh
   

3. 使用1356 6784 3409暗號敲門

   ┌──(kali㉿kali)-[~]
   └─$ knock 192.168.50.71 1356 6784 3409
   ┌──(kali㉿kali)-[~]
   └─$ nmap -A -p 22 192.168.50.71 -oA djinn
   Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-28 11:03 CST
   Nmap scan report for 192.168.50.71
   Host is up (0.00051s latency).
   
   PORT   STATE SERVICE VERSION
   22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
   | ssh-hostkey: 
   |   2048 b8:cb:14:15:05:a0:24:43:d5:8e:6d:bd:97:c0:63:e9 (RSA)
   |   256 d5:70:dd:81:62:e4:fe:94:1b:65:bf:77:3a:e1:81:26 (ECDSA)
   |_  256 6a:2a:ba:9c:ba:b2:2e:19:9f:5c:1c:87:74:0a:25:f0 (ED25519)
   Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
   

4. 使用3409 6784 1356 暗號關門

   ┌──(kali㉿kali)-[~]
   └─$ knock 192.168.50.71 3409 6784 1356
   ┌──(kali㉿kali)-[~]
   └─$ nmap -A -p 22 192.168.50.71 -oA djinn
   Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-28 11:03 CST
   Nmap scan report for 192.168.50.71
   Host is up (0.00028s latency).
   
   PORT   STATE  SERVICE VERSION
   22/tcp closed ssh