Open Sesame Secure your SSH server with Port Knocking
summary
Demonstrates securing an exposed SSH server on Debian 12 by using iptables and the port-knocking daemon Nockd to keep port 22 closed until a specific sequence of ports (3000→4000→5000) is hit within 30s. To prevent replay attacks, the demo derives the knock sequence from a TOTP-like shared secret (generating six numbers ×100 that change each minute). Alternatives covered include single-packet-authorization tools such as fwknop and Ruroco, and the demo shows opening SSH after a correct knock and then reclosing the port.
AI-written summary · about
chapters (10)
- 0:00SSH security overview
- 1:10Port knocking history
- 3:36SSH server risks
- 5:21Port knocking mechanics
- 6:24Demo: knockd and iptables
- 9:51Port knocking vulnerabilities
- 10:34TOTP dynamic solution
- 12:37Port knocking pros and cons
- 13:39Single Packet Authorization
- 14:42Conclusion & Q&A
related talks
43mFirewall Evasion and Remote Access with OpenSSH
15mUp your SSH security game
22mSecurity Showdown: The Overconfident Operator Vs the Nefarious...
01h 03mConnecting Remotely Like a Pro
12mCatch-22: Uncovering Compromised Hosts using SSH Public Keys
37mOpen Sesame! The full story behind opening a smart lock
01h 03mConnect remotely like a pro! Hack VPNs, avoid firewalls, connect even when your machine is down
38mSecure Shell Access Without SSH