Lion Cipher Lab
Hide a service behind Single Packet Authorization
- Cyber / Security Engineer
- Advanced
- ~75 min
- Free · no account required
Why it matters
Every internet-facing admin service — SSH above all — is a permanent target the moment its port answers. Scanners find it within minutes, brute-force and credential-stuffing run against it forever, and a single unpatched 0-day in the daemon is game over regardless of how strong your passwords are. The highest-leverage move is not a better password but a smaller target: make the port answer nobody until the connection attempt has already been authenticated. Single Packet Authorization does exactly that, and it does it without the operational weight of a full VPN, which is why it belongs in the…
What you'll learn
- Reasoning about attack surface and default-drop firewall posture
- Standing up fwknopd for Single Packet Authorization on Linux
- Generating and distributing Rijndael + HMAC SPA keys
- Configuring access.conf (FW_ACCESS_TIMEOUT, REQUIRE_SOURCE_ADDRESS) and fwknopd.conf
- Proving a service is invisible to nmap until an SPA packet gates it open
- Naming SPA's limits: NAT/CGNAT, replay, and compromised-client-key failure modes
Steps in this lab
- The threat model: an open port is a permanent target
- Port-knocking was the old idea — and why it fails
- Single Packet Authorization: the modern successor
- Install fwknop and set SSH to default-DROP
- Generate the SPA keys (Rijndael + HMAC)
- Configure the server: access.conf and fwknopd.conf
- Configure the client and build the SPA packet
- Prove it: invisible, knock, time-boxed open, expire
- Harden it, do it better, and know the failure modes
- Why this matters: authenticate before the stack sees a SYN