Arch Linux

Cygnet_Committee

Member

Registered: 2012-12-15

Posts: 19

can I use knockd to secure my "DNScrypt" on port 53?

... hey everybody, I'm trying to better secure my laptop that I use on public wifi. 

I'm using iptables with simple stateful wiki script and dnscrypt from these links below. I would like to add knockd to better secure my open port 53 for DNS. (and possibly port 68 for dhcpc if possible)

https://wiki.archlinux.org/index.php/Si … t_Knocking
https://blog.opendns.com/2012/02/16/tal … ux-rising/
https://aur.archlinux.org/packages/?O=0 … _Search=Go

this is what namp is showing me:

$ nmap -sU -vv 127.0.0.1

Starting Nmap 6.25 ( http://nmap.org ) at 2012-12-18 23:38 PST
Initiating UDP Scan at 23:38
Scanning localhost.localdomain (127.0.0.1) [1000 ports]
Discovered open port 53/udp on 127.0.0.1
Completed UDP Scan at 23:38, 1.22s elapsed (1000 total ports)
Nmap scan report for localhost.localdomain (127.0.0.1)
Host is up (0.0094s latency).
Scanned at 2012-12-18 23:38:24 PST for 1s
Not shown: 998 closed ports
PORT   STATE         SERVICE
53/udp open          domain
68/udp open|filtered dhcpc

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.32 seconds
           Raw packets sent: 1001 (28.677KB) | Rcvd: 2001 (85.304KB)

My question is this- Should I use knockd to secure port 53? (and possibly port 68)

... and if so, would I do it like this with new sequences for successful knocks. So, before I do this I thought I would ask an expert if this is the correct way, and if not... then how would I go about closing my ports and securing everything. I'm using a modified version of "example 3" from here: http://www.zeroflux.org/projects/knock

 [options]
        logfile = /var/log/knockd.log

  [opencloseSMTP]
        one_time_sequences = /etc/knockd/smtp_sequences
        seq_timeout        = 15
        tcpflags           = fin,!ack
        start_command      = /usr/sbin/iptables -A UDP -s %IP% -p udp --dport 53 -j ACCEPT
        cmd_timeout        = 5
        stop_command       = /usr/sbin/iptables -D UDP -s %IP% -p udp --dport 53 -j ACCEPT

... and if this is the way I'm supposed to do this, then would I do the same with --dport 68 for dhcpc?

Also, I don't have a directory for "/etc/knockd/smtp", is this created when running this code above?

And my last question about knockd is- Do I have to enable it with systemd?

Thanks in advance and I apologize for my ignorance in these matters.

Last edited by Cygnet_Committee (2012-12-19 09:36:31)

-Syu

Member

Registered: 2012-01-24

Posts: 29

Re: can I use knockd to secure my "DNScrypt" on port 53?

No apologies! To learn, you have to ask questions, right? Plus, your question is well formed. Welcome to the forums!

Sort answer: port knocking is good if there are very few people using the services you're running.

Long answer: you'll have to determine if you both need and want a port knocking daemon, by asking yourself a few questions.
- Who should have access to these ports? Just you? Then don't bother with a port knocker and just deny access to the ports from outside while allowing access from your own machine (using a firewall).
- If other people will actually be using your DHCP client and your DNS proxy on your laptop, then are those people willing to setup port knocking software on their machines to knock your ports every time they want an IP address or visit a website?

As for the open/close state of your ports, try to scan them from another machine. Like you did it, nmap only sees your ports from the system itself. The picture might be very different from the perspective of the outside world.

Cygnet_Committee

Member

Registered: 2012-12-15

Posts: 19

Re: can I use knockd to secure my "DNScrypt" on port 53?

Welcome to the forums!

Thank you.

I've been an Arch user for a long while, but it's been a few years since I asked a question on this forum so I started this new account (I mostly use the wiki and search the forums for similar questions).

ok, so I think I might have misunderstood the purpose of knockd.

I guess I will not need it until I start using SSH or have a server and need remote access rather than protecting my laptop's open ports like my iptables does?

So about port 53 and port 68, Is it ok for them to say open and open|filtered like it does in nmap?

thanks for the replys.

-Syu

Member

Registered: 2012-01-24

Posts: 29

Re: can I use knockd to secure my "DNScrypt" on port 53?

You're right, knockd is for hiding services that have to be exposed to the outside.

iptables is your firewall. I'd say it's not ok to leave your ports 53 and 68 open or open|filtered, except as seen from your own machine. You can configure iptables to block incoming trafic to those ports, and allow traffic from your own machine. That would make the ports show up as open of open|filtered in nmap when you run nmap from you own machine, but as closed when you scan your own machine with nmap from another machine.

Cygnet_Committee

Member

Registered: 2012-12-15

Posts: 19

Re: can I use knockd to secure my "DNScrypt" on port 53?

...except as seen from your own machine. You can configure iptables to block incoming trafic to those ports, and allow traffic from your own machine. That would make the ports show up as open of open|filtered in nmap when you run nmap from you own machine, but as closed when you scan your own machine with nmap from another machine.

Cool, I think the Simple_Stateful_Firewall has worked well: https://wiki.archlinux.org/index.php/Si … l_Firewall

I went to the "Shields Up" website and passed with a perfect stealth score and throughout all of the tests it kept on complementing my firewall: https://www.grc.com/x/ne.dll?rh1dkyd2

I just wasn't sure if using the dnscrypt-proxy had messed up my iptables rules. (which is what I had mistakenly thought that I could secure with knockd)

Last edited by Cygnet_Committee (2012-12-19 11:28:23)

-Syu

Member

Registered: 2012-01-24

Posts: 29

Re: can I use knockd to secure my "DNScrypt" on port 53?

Well, actually I'm betting it's your router's firewall that just scored a perfect stealth score. The "Shields Up" site doesn't allow me to view your score card, so I could be wrong and you might be connecting to the internet directly, but in case you have anything like a router, switch, firewall, gateway, access point or whatever you want to call it between you and grc.com, then you still don't know which ports I could access on your laptop if I was on your own local network.

So: hitch another laptop, phone, PDA or fridge ( ) on your own local network (LAN), get nmap there, and do the same nmap scan you did before, but with the local IP address (often starts with either 10.0 or 192.168) of your laptop as the target.
Or do

# iptables -L