Securing SSH with Single Packet Authorization (SPA): Implementing Fwknop and BPF on Ubuntu 26.04 LTS

Introduction: The Vulnerability of the Open SSH Port

For system administrators and DevOps engineers, securing Secure Shell (SSH) access is a foundational task. Standard hardening practices typically involve disabling password authentication, enforcing cryptographic keys, changing the default port 22, or deploying rate-limiting tools like Fail2ban. While these measures mitigate automated brute-force attacks, they do not solve a fundamental architectural flaw: the SSH port remains visibly open to the public internet.

An open port invites continuous reconnaissance. Attackers utilize advanced scanning tools to identify the SSH daemon, discover software versions, and potentially exploit zero-day vulnerabilities before patches can be deployed. To achieve true resilience, modern infrastructure demands a zero-trust network approach where services are completely invisible to unauthorized users. This is where Single Packet Authorization (SPA), combined with the power of Berkeley Packet Filter (BPF), transforms server security.

Understanding Single Packet Authorization (SPA) vs. Port Knocking

Before diving into the implementation, it is vital to contrast Single Packet Authorization (SPA) with its predecessor, traditional Port Knocking. Understanding these differences highlights why SPA is the superior choice for enterprise environments.

Port Knocking: Requires a client to send a sequence of connection attempts (SYN packets) to a specific set of closed ports in a precise order. Once the sequence is recognized by a log monitor, the firewall opens the target port. The flaw? This sequence can be easily sniffed out by attackers on the same network pathway, and it is highly susceptible to replay attacks.
Single Packet Authorization (SPA): Encapsulates an encrypted, non-replayable, and cryptographically signed payload within a single UDP (or occasionally TCP/ICMP) packet. The server-side daemon decrypts and verifies this single packet. If valid, the firewall dynamically opens the port exclusively for the source IP address of the requester for a limited time frame.

Note: Because SPA relies on strong encryption (symmetric or asymmetric), an attacker intercepting the packet gains zero actionable intelligence. The payload cannot be altered, forged, or replayed successfully.

The Role of Fwknop and BPF in Modern Linux Kernels

Fwknop (Firewall Knock Operator) is the industry standard open-source implementation of SPA. In its standard deployment, Fwknop monitors network traffic by looking at packet Captures via libpcap. However, on high-traffic Virtual Private Servers (VPS), parsing every packet at the user-space level can introduce noticeable CPU overhead and latency.

By leveraging Berkeley Packet Filter (BPF) on modern systems like Ubuntu 26.04 LTS, packet filtering is offloaded directly into the Linux kernel space. BPF bytecode filters out non-SPA packets with extreme efficiency before they ever reach user-space daemons. Combining Fwknop with BPF ensures that your stealth architecture remains highly performant, secure, and resilient against Distributed Denial of Service (DDoS) attempts aiming to overload the authorization mechanism.

Step-by-Step Implementation Guide on Ubuntu 26.04 LTS

This guide walks through configuring a complete SPA architecture using fwknop integrated with Netfilter/UFW and BPF acceleration on a fresh Ubuntu 26.04 instance.

Step 1: Prerequisites and Package Installation

Ensure your system repositories are up to date. You will need to install the Fwknop daemon on your server and the Fwknop client on your local management machine.

On the Ubuntu 26.04 Server, execute:

sudo apt update
sudo apt install fwknop-server ufw iptables -y

On your local client machine (Linux/macOS), install the client utility:

# For Debian/Ubuntu clients
sudo apt install fwknop-client -y
# For macOS via Homebrew
brew install fwknop

Step 2: Securing the Default Firewall State

To demonstrate the effectiveness of SPA, we must configure the Uncomplicated Firewall (UFW) to block all incoming SSH connections by default. Run the following commands on your server:

sudo ufw default deny incoming
sudo ufw default allow outgoing
# Explicitly ensure SSH is blocked/removed from global allow lists
sudo ufw delete allow 22/tcp
sudo ufw enable

Warning: Do not disconnect your current SSH session until the configuration is verified, otherwise you risk locking yourself out of the VPS permanently.

Step 3: Generating Encryption Keys

SPA requires shared cryptographic keys between the client and server. We will use the Fwknop client to generate these keys securely:

fwknop --key-gen

This command outputs a configuration block containing a KEY_BASE64 (symmetric encryption key) and an HMAC_KEY_BASE64 (for packet integrity hashing). Safely document these strings; they will be split between the server and client configuration files.

Step 4: Configuring the Fwknop Daemon with BPF

On the Ubuntu server, modify the primary configuration file located at /etc/fwknop/fwknopd.conf. Open it using your preferred text editor:

sudo nano /etc/fwknop/fwknopd.conf

Locate and verify the following key parameters to ensure BPF performance and correct interface binding:

PCAP_INTF           eth0; # Replace with your active network interface
ENABLE_IPT_FORWARDING  N;
# Enable BPF performance tuning
PCAP_FILTER         udp port 62201;

Next, define the access controls and keys within /etc/fwknop/access.conf:

sudo nano /etc/fwknop/access.conf

Append the following configuration block, substituting the keys generated in Step 3:

SOURCE              ANY
REQUIRE_SOURCE_ADDRESS  Y
KEY_BASE64          [Your_Generated_KEY_BASE64]
HMAC_KEY_BASE64     [Your_Generated_HMAC_KEY_BASE64]
FW_ACCESS_TIMEOUT   30
FORCE_PORT          22
FORCE_PROTO         tcp

Here, FW_ACCESS_TIMEOUT 30 dictates that the firewall will open port 22 for exactly 30 seconds. Your client must establish its SSH TCP connection handshake within this window. Once established, the connection remains active even after the firewall rule closes behind you.

Step 5: Enabling the Service

Start and enable the Fwknop daemon to run on system boot:

sudo systemctl enable fwknop-server
sudo systemctl start fwknop-server

Testing and Validating the Setup

From your local client machine, attempt to connect directly via SSH. The connection should time out, proving the port is successfully cloaked:

ssh user@your_vps_ip

Now, execute the SPA pulse using the Fwknop client tool to dynamically open the port:

fwknop -A tcp/22 -D your_vps_ip --a-key [KEY_BASE64] --a-hmac [HMAC_KEY_BASE64]

Alternatively, save these parameters inside your local ~/.fwknoprc file for frictionless execution. Once the single packet is sent, initiate your SSH connection immediately:

ssh user@your_vps_ip

You should successfully authenticate. Checking the server's firewall rules via sudo iptables -L during those 30 seconds will reveal a temporary rule explicitly allowing your specific source IP address to connect to port 22.

Conclusion and Best Practices

Implementing Single Packet Authorization utilizing Fwknop and kernel-level BPF filtering elevates your Ubuntu 26.04 VPS defense metrics to an elite tier. Automated scanners will view your server as completely unresponsive, effectively eliminating targeted exploit vectors against your SSH daemon.

As a best practice for production deployments, always maintain an out-of-band management console access method via your VPS hosting provider's dashboard. This guarantees administrative recovery options in the rare event of local key loss or configuration misalignment.