On 19.03.23 07:03, Philipp Marek wrote:
I quite like having a process listen on port 53 and wait for a dns
query containing a totp string to grant (temporary) access; that's a
2fa, and doing a "host 123456. my-ip" is easily automated in a shell
script as well...
I have to admit, I *really* like the TOTP idea.
For the time being, I've deployed a quasi-knocking KISS solution that
sends an unencrypted secret via a single UDP packet. Server side is
realized entirely with nftables:
table inet filter {
# set of IP addresses that have authenticated via knocking
set sshauth {
type ipv4_addr
size 255
flags timeout, dynamic
}
chain input {
type filter hook input priority filter; policy drop;
# SSH knocking with single UDP packet containing unencrypted secret
udp dport 12345 @ih,0,32 0xdeadbeef add @sshauth { ip saddr timeout 4h } counter
# alternatively TCP fast open can be used to knock with firewalls that only permit TCP port 22
tcp dport 22 tcp flags syn @ih,0,32 0xdeadbeef add @sshauth { ip saddr timeout 4h } counter reject with tcp reset
# accept new SSH connections from IP addresses that have knocked
ip saddr @sshauth tcp dport 22 ct state new counter accept
# accept established connections and reject the rest
ct state { established, related } accept
meta pkttype unicast ip protocol tcp counter reject with tcp reset
}
}
For SSH hosts only accessed by a select few of technically experienced
users that approach has worked like a charm.
Best regards,
Carsten
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
