Authors Universitatea Politehnica București Facultatea de Automatică și Calculatoare Catedra de Calculatoare Extension of a port knocking client- server architecture with NTP synchronization Traian Popeea, Vladimir Olteanu Laura Gheorghe, R ă zvan Rughiniș {

Outline Introduction Key words Objectives Architecture Technologies Solution Testing Problems Encountered Conclusions Questions RoEduNet Conference 20112

Introduction Port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. It has many disadvantages, as the server is left defenseless if the knock sequence is determined by the attacker RoEduNet Conference 20113

Key words Networking Security Port-knocking One-way functions NTP Client-server architecture RoEduNet Conference 20114

Objectives Implement a software application that will meet the following requirements: – Will provide dynamic knock sequences. – Will synchronize server and clients through NTP. – Will generate strong knock sequences through the use of one-way functions. – Will provide different knock sequences for different ports to be opened RoEduNet Conference 20115

Architecture RoEduNet Conference 20116

Technologies C OpenSSL NTP RoEduNet Conference 20117

Solutions Using an external NTP client (available on every *nix system) for time synchronization at the initialization of the server and clients A pre-shared initial key generated through the OpenSSL library using user-generated entropy A hash function based on PSK, time, source IP address, destination port A sequence of ports determined based on the hash function (splitting the 512-bit hash in 16-bit numbers representing ports) RoEduNet Conference 20118

Testing Generating 1 million keys RoEduNet Conference Function512 bits2048 bits md51.163s3.744s sha s13.197s sha s8.823s

Problems Encountered Public NTP servers are DoS-proof not allowing repeated requests at small time intervals => one initial synchronization followed by system clock queries The sharing of the PSK must be made out-of- program Determining the knock sequence lifespan Clients behind NAT do not have access (source address) RoEduNet Conference

Conclusions Another layer of security is added with the help of synchronization and cryptography. The number of attacks that can be performed is reduced. Using hash functions does not imply a significant latency RoEduNet Conference

References M. Krzywinski, “Port Knocking: Network Authentication Across Closed Ports”. SysAdmin Magazine 12: pp S. Krivis, “Port Knocking: Helpful or Harmful? – An Exploration of Modern Network Threats”, GIAC Security Essentials Certification, 2004, unpublished M. Doyle, “Implementing a Port Knocking System In C”, An Honors Thesis submitted in partial fulfillment of the requirements for Honors Studies in Physics, J. William Fulbright College of Arts and Sciences, The University of Arkansas, RoEduNet Conference

Thank you! Questions? RoEduNet Conference