Enhancing VPS Security: Implementing Single Packet Authorization (SPA) with Fwknop to Hide SSH Ports

Introduction to Server Cloaking and the Vulnerability of Open Ports

In the contemporary landscape of cloud computing, securing Virtual Private Servers (VPS) is a paramount concern for enterprise administrators and system engineers. Traditionally, securing Secure Shell (SSH) access involves changing the default port 22, enforcing public key authentication, and deploying rate-limiting tools such as Fail2ban. While these defense-in-depth measures mitigate brute-force campaigns, they fundamentally fail to address a critical architectural vulnerability: the port remains open and visible to internet-wide reconnaissance scanners.

As long as a socket is listening and accessible, threat actors can fingerprint the underlying service operating system, discover zero-day vulnerabilities, or launch sophisticated Distributed Denial of Service (DDoS) attacks. To eliminate this attack surface entirely, organizations are increasingly turning to a technique known as Server Cloaking via Single Packet Authorization (SPA). This guide provides a comprehensive technical breakdown of configuring SPA utilizing fwknop (FireWall Knock Operator) to make your SSH port entirely invisible to unauthorized scans while retaining seamless access for legitimate administrators.

Understanding Single Packet Authorization (SPA) vs. Port Knocking

Before diving into the implementation phase, it is crucial to differentiate Single Packet Authorization from its predecessor, classic Port Knocking. Classic port knocking relies on a specific sequence of connection attempts to closed ports (e.g., attempting to connect to port 1002, then 2005, then 9011) to trigger a firewall rule that temporarily opens the actual management port.

While innovative at its inception, classic port knocking suffers from several fatal architectural flaws:

Replay Attacks: An eavesdropper monitoring network traffic can capture the sequence of packet headers and replay them to open the firewall port.
Latency and Speed: Sending multiple TCP/IP or UDP connection attempts takes time and is highly susceptible to packet reordering over unreliable network paths.
Visibility: The sequence of connection attempts can still be logged or flagged by modern Intrusion Detection Systems (IDS).

Single Packet Authorization (SPA) solves these problems inherently. Instead of a multi-packet sequence, SPA utilizes a single, heavily encrypted, and authenticated packet—typically transmitted over UDP. This single packet contains a payload packed with cryptographic data, including a high-resolution timestamp, SHA-256 digests, and randomized nonces. Because the firewall drops all unsolicited packets by default, the server shows no open ports to any scanner. Only when the fwknopd daemon intercepts a valid, non-replayed SPA packet via a packet capture library (libpcap) does it dynamically alter the local Netfilter/iptables or firewalld ruleset to permit access to a specific source IP address for a finite window of time.

Prerequisites and Environment Setup

To successfully implement this architectural security pattern, ensure your infrastructure satisfies the following baseline criteria:

A Linux-based VPS: This guide assumes the utilization of an Ubuntu 22.04 or Debian 12 environment, though the principles translate seamlessly to RHEL-based distributions.
Root or Sudo Access: Administrative privileges are required to configure network interfaces, firewall daemons, and system configuration files.
A Local Client Machine: A Linux, macOS, or WSL-enabled Windows machine to execute the SPA client binaries.

Step 1: Installing Fwknop on the Server and Client

First, update your local repository index and install the necessary software packages on both the target VPS and your administration client.

On the VPS Server:

Execute the following command to install the FireWall Knock Operator daemon:

sudo apt update && sudo apt install fwknop-server iptables -y

We specifically include iptables here because fwknopd natively manipulates Netfilter chains to isolate and manage dynamic access controls efficiently.

On the Local Client Machine:

Install the client-side binary which will generate and sign the authorization packets:

sudo apt update && sudo apt install fwknop-client -y

Step 2: Configuring the Server FireWall Rulesets

The core mechanism of SPA requires a restrictive default firewall posture. We must configure the server's firewall to drop all incoming SSH connections by default, leaving the channel completely blind to the external internet.

Create or alter your iptables script to enforce the following baseline ruleset:

# Flush existing rules sudo iptables -F # Allow loopback traffic sudo iptables -A INPUT -i lo -j ACCEPT # Allow established and related connections sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # DROP ALL INCOMING SSH TRAFFIC (Port 22) sudo iptables -A INPUT -p tcp --dport 22 -j DROP # Set default policies to DROP for safety sudo iptables -P INPUT DROP

Warning: Do not terminate your active SSH session yet. If you close your connection before configuring fwknop properly, you risk permanently locking yourself out of your cloud server. Keep your current terminal window active.

Step 3: Configuring the Fwknop Daemon

The configuration of the server daemon relies primarily on two key files located within the /etc/fwknop/ directory: fwknopd.conf and access.conf.

Modifying fwknopd.conf

Open /etc/fwknop/fwknopd.conf in your preferred text editor and locate the network interface configuration. Define the network interface that routes internet-bound traffic (typically eth0 or ens3):

PCAP_INTF eth0;

This tells the underlying libpcap library exactly which physical or virtual interface to sniff for incoming single packet authorization payloads.

Modifying access.conf

The access.conf file defines the cryptographic parameters and access permissions for users. Generate unique asymmetric encryption keys or strong symmetric keys. For maximum security, we will use standard Rijndael symmetric keys along with an HMAC (Hash-based Message Authentication Code) key to guarantee packet integrity and authenticity.

Generate keys on the server or client using a secure random generator, then edit /etc/fwknop/access.conf to declare the configuration stanza:

SOURCE ANY OPEN_PORTS tcp/22 KEY_TYPE Rijndael KEY Your_Super_Secret_Encryption_Key_Here HMAC_KEY Your_Super_Secret_HMAC_Key_Here FW_ACCESS_TIMEOUT 30

In this definition, FW_ACCESS_TIMEOUT 30 specifies that once a valid packet is interpreted, the firewall will open port 22 for exactly 30 seconds. Within this frame, the client must initialize the TCP handshake. Once established, the connection remains active indefinitely due to our established/related iptables rule, but no new connections from any other source will be accepted.

Restart and enable the service daemon to apply changes:

sudo systemctl restart fwknop-server sudo systemctl enable fwknop-server

Step 4: Initiating Connection from the Client

With the server operating in complete stealth mode, your standard SSH connection attempts will time out. To gain entry, you must now utilize the client-side binary to send an explicit authorization payload.

Execute the client command to transmit an authenticated SPA packet over UDP port 62201 (the default port for fwknop):

fwknop -A tcp/22 -D YOUR_VPS_IP_ADDRESS --a-key Your_Super_Secret_Encryption_Key_Here --a-hmac Your_Super_Secret_HMAC_Key_Here

To streamline operational efficiency, you can store these credentials within your local user profile configurations inside ~/.fwknoprc:

[vps-stealth] SPA_SERVER YOUR_VPS_IP_ADDRESS ACCESS tcp/22 KEY Your_Super_Secret_Encryption_Key_Here HMAC_KEY Your_Super_Secret_HMAC_Key_Here

With the configuration file saved, triggering authorization becomes trivial:

fwknop -n vps-stealth && ssh user@YOUR_VPS_IP_ADDRESS

Verifying and Auditing Security Posture

To confirm that your VPS is fully cloaked, initiate an external Nmap scan from an unrelated third-party machine against your server IP:

nmap -p 22 YOUR_VPS_IP_ADDRESS

The scan result should explicitly return a state of filtered or show no response at all, confirming that port 22 is functionally invisible to the broader internet. Concurrently, checking the system systemd logs via journalctl -u fwknop-server will show successful authentication receipts and the real-time execution of dynamic iptables generation commands every time you authenticate.

Conclusion

Implementing Single Packet Authorization with Fwknop transitions your organizational defense architecture from a passive, defensive paradigm to an assertive, zero-visibility posture. By completely hiding public infrastructure access vectors like SSH behind a wall of zero-response packet drops, you completely eliminate automated malicious reconnaissance campaigns, exploit scanning, and brute force vectors. Integrating this strategy into your core systems provisioning workflows ensures your cloud footprint remains secure, resilient, and utterly invisible to the adversaries of the digital frontier.