:man source: Fwknop Client :man manual: Fwknop Client FWKNOP(8) ========= NAME ---- fwknop - Firewall Knock Operator SYNOPSIS -------- *fwknop* *-A* <'proto/ports'> *-R*|*-a*|*-s -D* <'host'> ['options'] DESCRIPTION ----------- *fwknop* implements an authorization scheme known as Single Packet Authorization (SPA) for Linux systems running iptables. This mechanism requires only a single encrypted and non-replayed packet to communicate various pieces of information including desired access through an iptables or ipfw policy. The main application of this program is to use iptables in a default-drop stance to protect services such as 'SSH' with an additional layer of security in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) much more difficult. An authorization server *fwknopd* passively monitors authorization packets via 'libpcap' and hence there is no ``server'' to which to connect in the traditional sense. Any service protected by *fwknop* is inaccessible (by using 'iptables' or 'ipfw' to intercept packets within the kernel) before authenticating; anyone scanning for the service will not be able to detect that it is even listening. Single Packet Authorization offers many advantages over port knocking, including non-replayability of SPA packets, ability to use asymmetric ciphers (such as Elgamal), and SPA cannot be broken by simply spoofing packets to duplicate ports within the knock sequence on the server to break port knocking authentication. SPA packets can easily be spoofed as well (this is a good thing in this context), and this makes it possible to make it appear as though, say, www.yahoo.com is trying to authenticate to a target system but in reality the actual connection will come from a seemingly unrelated IP. Authorization packets are either encrypted with the 'Rijndael' block cipher or via 'GnuPG' and associated asymmetric ciphers. If the symmetric encryption method is chosen, then the encryption key is shared between the client and server (see the fwknopd 'access.conf' file for details). If the GnuPG method is chosen, then the encryption keys are derived from GnuPG key rings. SPA packets generated by fwknop running as a client adhere to the following format (before they are encrypted): .......................... random number (16 bytes) username timestamp software version mode (command mode (0) or access mode (1)) if command mode => command to execute else access mode => IP,proto,port message digest (SHA512 / SHA384 / SHA256 / SHA1 / MD5) .......................... Each of the above fields are separated by a ":" character due to the variable length of several of the fields, and those that might contain ":" characters are base64 encoded. The message digest (*SHA256* by default in all versions of *fwknop* greater than 1.9.1) allows the server to check message integrity after decryption, and the 16 bytes of random data ensures (with high probability) that no two messages are identical. This ensures that replay attacks are not possible against *fwknop*. For each packet coming from an *fwknop* client, the *fwknopd* server can cache the digest calculated over the entire packet and compares against previous packet digests in order to detect attempted replay attacks. Syslog alerts are generated if a replay is detected. By default, the *fwknop* client sends authorization packets over UDP port 62201, but this can be altered with the *--server-port* argument. The server must first be configured to acquire the SPA data on the changed protocol-port. Also, *fwknop* can send the SPA packet over a random port via the *--rand-port* argument. See 'fwknopd(8)' for further details. See the *EXAMPLES* section for example invocations of the *fwknop* client. REQUIRED ARGUMENTS ------------------ These required arguments can be specified via command-line or from within the '.fwknoprc' file (see '-n, --named-config' option and the FWKNOPRC FILE section below. *-D, --destination*='':: Direct the *fwknop* client to authenticate with the *fwknopd* daemon/service at the specified destination hostname or IP address. The connection mode is discovered by the *fwknopd* daemon/service when it decrypts and parses the authentication packet. *-A, --access*='':: Provide a list of ports and protocols to access on a remote computer running *fwknopd*. The format of this list is ``+/.../+'', e.g. ``tcp/22,udp/53''. *NOTE:* The vast majority of usages for *fwknop* require the *-A* argument, but sending full commands with the *--server-cmd* argument via an SPA packet to be executed by *fwknopd* does not require this argument. *-R|-a|-s*:: One of these options (see below) is required to tell the remote *fwknopd* daemon what IP should be let through the local firewall. It is recommend to use the *-R* or *-a* options instead of *-s* in order to harden SPA communications against possible 'Man-In-The-Middle' (MITM) attacks. GENERAL OPTIONS --------------- *-h, --help*:: Print a usage summary message and exit. *-B, --save-packet*='':: Instruct the *fwknop* client to write a newly created SPA packet out to the specified file so that it can be examined off-line. *-G, --get-key*='':: Load an encryption key/password from the specified file. The key file contains a line for each destination hostname or IP address, a colon (":"), optional space and the password, followed by a newline. Note that the last line has to have a terminating newline character. Also note: though this is a convenience, have a file on your system with cleartext passwords is not a good idea and is not recommended. *-l, --last-cmd*:: Execute *fwknop* with the command-line arguments from the previous invocation (if any). The previous arguments are parsed out of the '~/.fwknop.run' file. *-n, --named-config*='':: Specify the name of the configuration stanza in the ``$HOME/.fwknoprc'' file to pull configuration and command directives. These named stanzas alleviate the need for remembering the various command-line arguments for frequently used invocations of *fwknop*. See the section labeled, FWKNOPRC FILE below for a list of the valid configuration directives in the '.fwknoprc' file. *--show-last*:: Display the last command-line arguments used by *fwknop*. *-T, --test*:: Test mode. Generate the SPA packet data, but do not send it. Instead, print a break-down of the SPA data fields, then run the data through the decryption and decoding process and print the break-down again. This is primarily a debugging feature. *-v, --verbose*:: Run the *fwknop* client in verbose mode. This causes *fwknop* to print some extra information about the current command and the resulting SPA data. *-V, --Version*:: Display version information and exit. SPA OPTIONS ----------- *-a, --allow-ip*='':: Specify IP address that should be permitted through the destination *fwknopd* server firewall (this IP is encrypted within the SPA packet itself). This is useful to prevent a MTIM attack where a SPA packet can be intercepted enroute and sent from a different IP than the original. Hence, if the *fwknopd* server trusts the source address on the SPA packet IP header then the attacker gains access. The *-a* option puts the source address within the encrypted SPA packet, and so thwarts this attack. The *-a* option is also useful to specify the IP that will be granted access when the SPA packet itself is spoofed with the *--spoof-src* option. Another related option is *-R* (see below) which instructs the *fwknop* client to automatically resolve the externally routable IP address the local system is connected to by querying a website that returns the actual IP address it sees from the calling system. *-C, --server-cmd*='':: Instead of requesting access to a service with an SPA packet, the *--server-cmd* argument specifies a command that will be executed by the *fwknopd* server. The command is encrypted within the SPA packet and sniffed off the wire (as usual) by the *fwknopd* server. *-g, --gpg-encryption*:: Use GPG encryption on the SPA packet (default if not specified is Rijndael). *Note:* Use of this option will require the specification of a GPG recipient (see *--gpg-recipient* along with other GPG-related options below). *-H, --http-proxy*='[:port]':: Specify an HTTP proxy that the *fwknop* client will use to send the SPA packet through. Using this option will automatically set the SPA packet transmission mode (usually set via the *--server-proto* argument) to "http". You can also specify the proxy port by adding ":" to the proxy host name or ip. *-m, --digest-type*='':: Specify the message digest algorithm to use in the SPA data. Choices are: *MD5*, *SHA1*, *SHA256* (the default), *SHA384*, and *SHA512*. *-N, --nat-access*='':: The *fwknopd* server offers the ability to provide SPA access through an iptables firewall to an internal service by interfacing with the iptables NAT capabilities. So, if the *fwknopd* server is protecting an internal network on an RFC-1918 address space, an external *fwknop* client can request that the server port forward an external port to an internal IP, i.e. ``+--NAT-access 192.168.10.2,55000+''. In this case, access will be granted to 192.168.10.2 via port 55000 to whatever service is requested via the *--access* argument (usually tcp/22). Hence, after sending such an SPA packet, one would then do ``ssh -p 55000 user@host'' and the connection would be forwarded on through to the internal 192.168.10.2 system automatically. Note that the port ``55000'' can be randomly generated via the *--nat-rand-port* argument (described later). *--nat-local*:: On the *fwknopd* server, a NAT operation can apply to the local system instead of being forwarded through the system. That is, for iptables firewalls, a connection to, say, port 55,000 can be translated to port 22 on the local system. By making use of the *--nat-local* argument, the *fwknop* client can be made to request such access. This means that any external attacker would only see a connection over port 55,000 instead of the expected port 22 after the SPA packet is sent. *--nat-rand-port*:: Usually *fwknop* is used to request access to a specific port such as tcp/22 on a system running *fwknopd*. However, by using the *--nat-rand-port* argument, it is possible to request access to a particular service (again, such as tcp/22), but have this access granted via a random translated port. That is, once the *fwknop* client has been executed in this mode and the random port selected by *fwknop* is displayed, the destination port used by the follow-on client must be changed to match this random port. For SSH, this is accomplished via the *-p* argument. See the *--nat-local* and *--nat-access* command line arguments to *fwknop* for additional details on gaining access to services via a NAT operation. *-p, --server-port*='':: Specify the port number where *fwknopd* accepts packets via libpcap or ulogd pcap writer. By default *fwknopd* looks for authorization packets over UDP port 62201. *-P, --server-proto*='':: Set the protocol (udp, tcp, http, tcpraw, or icmp) for the outgoing SPA packet. Note: The *tcpraw* and *icmp* modes use raw sockets and thus require root access to run. Also note: The *tcp* mode expects to establish a TCP connection to the server before sending the SPA packet. This is not normally done, but is useful for compatibility with the Tor for strong anonymity; see 'http://tor.eff.org/'. In this case, the *fwknopd* server will need to be configured to listen on the target TCP port (which is 62201 by default). *-Q, --spoof-src*='':: Spoof the source address from which the *fwknop* client sends SPA packets. This requires root on the client side access since a raw socket is required to accomplish this. Note that the *--spoof-user* argument can be given in this mode in order to pass any *REQUIRE_USERNAME* keyword that might be specified in '/etc/fwknop/access.conf'. *-r, --rand-port*:: Instruct the *fwknop* client to send an SPA packet over a random destination port between 10,000 and 65535. The *fwknopd* server must use a *PCAP_FILTER* variable that is configured to accept such packets. For example, the *PCAP_FILTER* variable could be set to: ``+udp dst portrange 10000-65535+''. *-R, --resolve-ip-http*:: This is an important option, and instructs the *fwknop* client and the *fwknopd* daemon/service to query a web server that returns the caller's IP address (as seen by the web server). In some cases, this is needed to determine the IP address that should be allowed through the iptables policy at the remote fwknopd server side. This is useful if the *fwknop* client is being used on a system that is behind an obscure NAT address. Presently, *fwknop* uses the URL: 'http://www.cipherdyne.org/cgi-bin/myip' to resolve the caller IP. *-s, --source-ip*:: Instruct the *fwknop* client to form an SPA packet that contains the special-case IP address ``+0.0.0.0+'' which will inform the destination *fwknopd* SPA server to use the source IP address from which the SPA packet originates as the IP that will be allowed through upon modification of the firewall ruleset. This option is useful if the *fwknop* client is deployed on a machine that is behind a NAT device. The permit-address options *-s*, *-R* and *-a* are mutually exclusive. *--time-offset-plus*='