-1

The server is supposed to silently ignore any requests (including ping) unless it receives correct credentials with initial request. Nobody else can tell that the host even exists.

I am talking about a very basic "authentication server", a mechanism to selectively make a host visible only to some guests. When the client sends correct credentials, the firewall makes the host visible to its IP and begins to accept any connections from it.

  • What kind of server? What does it serve? What operating system is it running? How would the password be given? What kind of access does the server allow? Please edit your question and add more details It is impossible to answer at the moment. – terdon Sep 26 '15 at 20:45
  • 3
    Have you already looked into port knocking? – Bratchley Sep 26 '15 at 22:04
  • Could someone explain the reasons they suspect my question was downvoted? (Wonderful lead, Bratchley. Thank you.) – argle Sep 26 '15 at 22:18
  • Speculating: maybe because you're asking for something that's pretty useless and not giving any motivation. Because you didn't say why you wanted this, answers may or may not solve your actual problem. – Gilles 'SO- stop being evil' Sep 27 '15 at 1:09
  • This question may be useful to other newbies that would otherwise find it hard to get from search terms like "port scanning", "stealth", "security by obscurity", to "port knocking", "single packet authorization" and see for themselves what a bad idea they almost had (expressed in words, not in votes). In general, downvotes must not impose expectations that the questions weren't supposed to meet. – argle Sep 27 '15 at 15:40
2

If your host doesn't respond to anything, then your options to communicate with it are limited. You aren't going to be able to do things like send it a user name and password, since that would require opening a TCP connection, and that requires traffic in both directions.

You can do port knocking to make the server start responding to a usable protocol such as SSH. Port knocking works by encoding a password into a series of packets that don't require a connected protocol, for example sending pings on a series of ports, or sending an ICMP or UDP packet to a specific port containing a password.

Note that any method that requires the server to be stealthy has an inherent weakness: somebody observing the traffic can see the traffic that leads the server to reply, and replay that sequence. You can limit this by making the password depend on the time, but beware that this can lock you out if the clocks on the client and the server get out of synch.

Obviously the server won't be stealthy while you're communicating with it.

Setting up port knocking isn't that difficult, you can find tutorials for it on the web. But even so it's usually not worth the trouble. Port knocking does not improve privacy and does not defend against any serious threat. Its main advantage is to make your server invisible to generic probes that attempt to exploit security vulnerabilities, but those probes are harmless if you keep your server up-to-date with security patches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.