Skip to main content

UDP port knocking suite with HMAC-PSK authentication

Project description

pyknock

UDP port knocking suite with HMAC-PSK authentication. Once it receives valid packet signed with valid pre-shared key, it runs command to open or close access. Commands should be specified by user via server command line. Server allows use of substitution placeholders in configured commands:

  • $ip - IP address mentioned in signed packet
  • $af - IP address type: inet or inet6
  • $cmd - requested action: open or close

See Usage for examples.


:heart: :heart: :heart:

You can say thanks to the author by donations to these wallets:

  • ETH: 0xB71250010e8beC90C5f9ddF408251eBA9dD7320e
  • BTC:
    • Legacy: 1N89PRvG1CSsUk9sxKwBwudN6TjTPQ1N8a
    • Segwit: bc1qc0hcyxc000qf0ketv4r44ld7dlgmmu73rtlntw

Main Idea

In this application UDP datagrams are choosen for a reason. Typical configuration of firewalled machine allows only packets to some public ports and drops packets to all other ports. With UDP external observer can't distinguish between accepted packet and packet dropped by firewall. Therefore, if firewall configuration drops all UDP packets except packets to pyknock port, external observer can't even detect there is something awaiting for magic packet. So, it may be used to hide machine completely from network for unauthenticated peers. Also, it may be used as classical port-knocking solution, adding another protection layer to sensitive network application.

Features

  • Uses cryptographically authenticated messages.
  • Resistant to replay attacks.
  • Post-quantum ready cryptography (HMAC-PSK with SHA-256).
  • Works completely in user-space. May run even as unprivileged user.

Requirements

Only Python 2.6+ required. Python 3 is also supported.

Installation

Place file anywhere you want and run. Or use pip install pyknock to install it into your system as python package. Scripts shall become available at standard binary paths.

Usage

Server example:

pyknock-server MySecretPSK 'ipset add -exist myallowedset $ip timeout 3600' 'ipset del -exist myallowedset $ip'

Client example:

pyknock-client open my-protected-host.com MySecretPSK

Client behind NAT example:

pyknock-client -S $(curl -s https://canihazip.com/s) open my-protected-host.com MySecretPSK

See help for more options.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pyknock-0.4.3.tar.gz (5.0 kB view details)

Uploaded Source

Built Distribution

pyknock-0.4.3-py2.py3-none-any.whl (6.6 kB view details)

Uploaded Python 2 Python 3

File details

Details for the file pyknock-0.4.3.tar.gz.

File metadata

  • Download URL: pyknock-0.4.3.tar.gz
  • Upload date:
  • Size: 5.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.2.0 pkginfo/1.5.0.1 requests/2.24.0 setuptools/49.3.0 requests-toolbelt/0.9.1 tqdm/4.48.2 CPython/3.8.4

File hashes

Hashes for pyknock-0.4.3.tar.gz
Algorithm Hash digest
SHA256 da592e15a5430f79855e1a666b4935ac29195564936e64bdaa3f12fd230127b9
MD5 5e8f333a4dd57c19f7c607bf0bd633e8
BLAKE2b-256 46618499eea1b59cfedbfa541200cf90db7858fb1aaa0ed9222f299dba380a17

See more details on using hashes here.

File details

Details for the file pyknock-0.4.3-py2.py3-none-any.whl.

File metadata

  • Download URL: pyknock-0.4.3-py2.py3-none-any.whl
  • Upload date:
  • Size: 6.6 kB
  • Tags: Python 2, Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.2.0 pkginfo/1.5.0.1 requests/2.24.0 setuptools/49.3.0 requests-toolbelt/0.9.1 tqdm/4.48.2 CPython/3.8.4

File hashes

Hashes for pyknock-0.4.3-py2.py3-none-any.whl
Algorithm Hash digest
SHA256 1126d25776c69ddcc798edbdb047d4b9cf862ce036265a294b3b4d60944b036a
MD5 e05c4a60314bec886e511b096298c0f0
BLAKE2b-256 5a761fd05b1088f32b7f8d56976cc8a5a2e6ebdf490dcf6d8ed2eb03ae5dc823

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page