Forum: Ruby Port Knocking

Announcement (2017-05-07): www.ruby-forum.com is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see rubyonrails.org/community and ruby-lang.org/en/community for other Rails- und Ruby-related community platforms.
5a3696496b80613b55c3b7bc3b2d94bc?d=identicon&s=25 unknown (Guest)
on 2005-12-21 02:49
(Received via mailing list)
Has anyone seen (or written) any port knocking implementations in Ruby?
I couldn't see any in the RAA or RubyForge (unless it's under a name I
missed).  Is there any interest for this sort of thing?  I wrote a
mini-script to do it with ICMP but I'm not a programmer and it most
likely bites.

http://www.spannermonkey.info/rknock.html

It requires libpcap and ruby-libpcap. Suggestions are welcome. I wanted
to be able to knock without a client, hence the ping thing.


Sven
E2b3bbf241a5daee3ee7696a7d4b2015?d=identicon&s=25 Vrtwo Lastname (d0t1q)
on 2005-12-21 04:32
(Received via mailing list)
Pretty neat.. I was interested in doing this a while back but never
got around to it (and never will at this rate).

Are typical port-knocking setups tcp or udp based? I would think that
the handshake portion would be UDP..

Because ICMP is filtered by many ISPs, how difficult would it be to
set this up with udp?
5a3696496b80613b55c3b7bc3b2d94bc?d=identicon&s=25 unknown (Guest)
on 2005-12-21 05:20
(Received via mailing list)
Port knocking is normally TCP and UDP although there are a number of
implementations with ICMP. It wouldn't be much harder to do with UDP
but that means that a client would be required as I don't know of
any(standard) unix programs that can send custom TCP or UDP packets.
I'm looking at fixing a few of the things in the script like the
timeout <shudder/> so I might throw in an option for TCP/UDP and a
small client.
25e11a00a89683f7e01e425a1a6e305c?d=identicon&s=25 Wilson Bilkovich (Guest)
on 2005-12-21 06:47
(Received via mailing list)
On 12/20/05, sven.schott@gmail.com <sven.schott@gmail.com> wrote:
> Port knocking is normally TCP and UDP although there are a number of
> implementations with ICMP. It wouldn't be much harder to do with UDP
> but that means that a client would be required as I don't know of
> any(standard) unix programs that can send custom TCP or UDP packets.
> I'm looking at fixing a few of the things in the script like the
> timeout <shudder/> so I might throw in an option for TCP/UDP and a
> small client.

Check out Timeout, part of the standard library.
http://www.ruby-doc.org/stdlib/libdoc/timeout/rdoc/

Also, you can portknock on TCP with any web browser. Just in case that
helps. :)
C6858f4b8ec263c8c3c58759494e926a?d=identicon&s=25 Andy Delcambre (Guest)
on 2005-12-21 06:56
(Received via mailing list)
On 12/20/05, sven.schott@gmail.com <sven.schott@gmail.com> wrote:
> Port knocking is normally TCP and UDP although there are a number of
> implementations with ICMP. It wouldn't be much harder to do with UDP
> but that means that a client would be required as I don't know of
> any(standard) unix programs that can send custom TCP or UDP packets.
> I'm looking at fixing a few of the things in the script like the
> timeout <shudder/> so I might throw in an option for TCP/UDP and a
> small client.
>

If you are wanting to test, hping ( http://www.hping.org/ ) can send
arbitrary packets (of pretty much any type).

Might look into that for udp/tcp testing.

Andy Delcambre
Ff260830c27224f0e15f37362a6256d0?d=identicon&s=25 Paul Duncan (Guest)
on 2005-12-21 14:54
(Received via mailing list)
* sven.schott@gmail.com (sven.schott@gmail.com) wrote:
> Has anyone seen (or written) any port knocking implementations in Ruby?
> I couldn't see any in the RAA or RubyForge (unless it's under a name I
> missed).  Is there any interest for this sort of thing?

Probably.  I've been using Ruby more and more frequently in place of
Perl for system administration tasks, and every little google hit helps.

You might also be interested in the recent Ars Technica article about
monitoring packets with libpcap and Ruby:

  http://arstechnica.com/articles/columns/linux/linu...

> I wrote a
> mini-script to do it with ICMP but I'm not a programmer and it most
> likely bites.

All I know is your debugging output is great!

When it's finished will it say "Chevron 7 locked" or "Chevron 7
engaged", or both? :D
5a3696496b80613b55c3b7bc3b2d94bc?d=identicon&s=25 unknown (Guest)
on 2005-12-21 21:55
(Received via mailing list)
Thanks for the tip. I've been wanting to implement a proper timeout.
The current one is packet dependant. It works, but it's not nice.

I tried telnet and netcat to portknock but if there's no port open,
nothing comes up in the dump. I don't know why that is but I'm guessing
that libpcap only shows the packets if the TCP session is established.
Maybe there is an option to change that behaviour but I couldn't find
it. You can try it just with tcpdump -n.  When you try to connect to
the local ip address using port 7000, it doesn't show up in the dump.
Same deal with ruby-libpcap(same library).

require 'pcap'
dev = Pcap.lookupdev
cap = Pcap::Capture.open_live(dev)
cap.loop do |pkt|
    puts pkt
end

I am using MacOS 10.4 so it may be some Mac weirdness at the kernel
level or how libpcap talks to the kernel but I've had no success so
far. That's why I was interested to see if anyone else had done it.

Sven
B4a3fe24e9fb82df573ae5b38aa3b872?d=identicon&s=25 Derek Chesterfield (Guest)
on 2005-12-30 12:24
(Received via mailing list)
On 21 Dec 2005, at 5:32am, sven.schott@gmail.com wrote:

> You can try it just with tcpdump -n.  When you try to connect to
> the local ip address using port 7000, it doesn't show up in the dump.

To dump packets to/from the loopback, you need to tell tcpdump to
look at the correct interface [otherwise it defaults to the Ethernet
- en0 on Mac OS X]:
This topic is locked and can not be replied to.