PuTTY wish port-knocking

Home | Licence | FAQ | Docs | Download | Keys | Links
Mirrors | Updates | Feedback | Changes | Wishlist | Team

We have been asked several times to implement Port Knocking: a mechanism for making a running service appear to be a connection-refusing closed port unless the right sequence of "knocks" (attempted connections to genuinely closed ports) is received before the connection attempt.

The PuTTY team is collectively unconvinced that this is a good idea. For a start, it's not universally usable, because many firewalls won't let the knocks through. (Obviously the firewall at the server end is precisely what will need to be specifically listening out for the knock, but firewalls at the client end or in between are likely to cause a lot more trouble. And in particular, if you're connecting through an SSH tunnel, you'll have a hard time sending a knock.) Also, since the knock is effectively sent in cleartext, it doesn't buy you a great deal of security - the only real gain is that your service appears to be a closed port to anyone doing a port scan, and although that might have advantages it might also cause administrators to become more relaxed about the real security of their service. It seems like a lot of effort for very little gain.

Much more importantly, though, we don't like the idea of this mechanism having to be implemented separately in every network client program - particularly given the hints on the port knocking website that more inventive forms of knock may be developed in future, which would of course mean we'd have to keep up with development. To implement and maintain this in PuTTY and all other network utilities would be a huge amount of effort.

If this is to be done at all, it should be done in a largely client-independent manner. For example:

• Write a small command-line application which performs the port knock, makes the connection, and then gateways the connection to its standard input and output: a port-knocking enabled equivalent of nc(1). Then invoke that using the "Local" proxy setting in PuTTY (works on both Windows and Unix).
• Write a SOCKS server which understands your port knocking, and performs the appropriate knock before proxying any given connection. Point PuTTY at it using our existing SOCKS proxy support.
• An even simpler approach: write a script which runs the knock program, and then launches PuTTY and tells it to connect to the appropriate host. The doorman.sourceforge.net client, for example, is intended to be used this way.
• (Unix only) Construct a dynamic library which replaces the connect(2) system call so that it performs the knock first. Then you can use LD_PRELOAD to apply it to almost any application.

If anyone really wants to see this feature in PuTTY, they should probably look into one of the above options.

Audit trail for this wish.