1

First off, I am well aware that port-knocking does create more security-feeling than real saftey, and that it is mainly a security-by-obscurity thing. Nevertheless: Are there are open-source projects around which use e.g. knockd as replacement for a full-fledge architecture to steer a simple IOT-device?

More details on the setup

Let me elaborate a bit my idea: The IOT-device is a Raspberry (or any other single board computer) which performs a visible action (like opening or closing a window shutter). In other words, I do not need any feedback from the device via IP or UDP protocol. All I need is a demon of some kind listening for a handful of commands (for the window shutter this may be open-completely, close completely, open further by a third if state allows, close further by a third if state allows). The Raspberry is aware of the current state of the shutter, accepts a new command only once the last one is fully executed, and limits the number of commands per time interval. If my knocking-sequence is long-enough, I would reach a higher security than many IOT-devices on the market (remember the old joke: "S" stands for security in IOT).

While brain-storming the idea of my simple Raspberry-window-shutter-project, the old CGI bin approach came into my mind, nowadays it would possibly be a python http.server or something similar. Both these approaches seem a bit overkill to me. There are some ready-to-use mobile apps like Knock on Ports which I could immediately use to test my setup. But before I reinvent the wheel, I would love to know whether I have overseen some existing projects going in a similar direction.

Further reading

B--rian
  • 204
  • 2
  • 14
  • 3
    I don't fully understand the question. Isn't a [`knockd`](https://linux.die.net/man/1/knockd) all you need on the IOT device? You can configure different knocking sequences for the different window shutter actions, e.g. `sequence = 7000,8000,9000; command = python open_completely.py` . What is lacking in `knockd` for your use case?` – Saaru Lindestøkke Jun 30 '21 at 21:01
  • https://www.cipherdyne.org/fwknop/ / https://www.cipherdyne.org/blog/2015/06/new-android-single-packet-authorization-client-fwknop2.html / https://manpages.debian.org/fwknopd.8 / https://manpages.debian.org/fwknop.8 comes to mind for a secure approach, but you already linked it. So what's the problem with this one? The package would be available on RPi. – A.B Jul 03 '21 at 20:50

0 Answers0