head	1.4;
access;
symbols
	RELEASE_8_3_0:1.2
	RELEASE_9_0_0:1.2
	RELEASE_7_4_0:1.1
	RELEASE_8_2_0:1.1
	RELEASE_6_EOL:1.1
	RELEASE_8_1_0:1.1
	RELEASE_7_3_0:1.1
	RELEASE_8_0_0:1.1
	RELEASE_7_2_0:1.1
	RELEASE_7_1_0:1.1
	RELEASE_6_4_0:1.1;
locks; strict;
comment	@# @;


1.4
date	2013.03.01.17.42.53;	author svnexp;	state Exp;
branches;
next	1.3;

1.3
date	2012.11.28.00.11.25;	author svnexp;	state Exp;
branches;
next	1.2;

1.2
date	2011.07.03.14.02.45;	author ohauer;	state Exp;
branches;
next	1.1;

1.1
date	2008.06.13.03.43.50;	author edwin;	state Exp;
branches;
next	;


desc
@@


1.4
log
@## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/313158
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
@
text
@SHA256 (fwknop-2.0.4.tar.gz) = e6a88e969264ff23bd5837a47e5b60b8c4d36fc8a2326c6b377f8447ecf2adea
SIZE (fwknop-2.0.4.tar.gz) = 1401321
@


1.3
log
@## SVN ##
## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/ 307863
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ## r307863 | rakuco | 2012-11-27 21:41:29 +0000 (Tue, 27 Nov 2012) | 11 lines
## SVN ##
## SVN ## Update to 2.0.3.
## SVN ##
## SVN ## This new version includes a migration from Perl to C and support for
## SVN ## ipfw and pf.
## SVN ##
## SVN ## While here, trim the Makefile headers.
## SVN ##
## SVN ## PR:		ports/171951
## SVN ## Submitted by:	Sean Greven <sean.greven@@gmail.com> (maintainer)
## SVN ## Feature safe:	yes
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ##
@
text
@d1 2
a2 2
SHA256 (fwknop-2.0.3.tar.gz) = f7f306a66c641020e7c7a820eaa3743e2700ddee6e26cca37440db95df56b986
SIZE (fwknop-2.0.3.tar.gz) = 904769
@


1.2
log
@-remove MD5
@
text
@d1 2
a2 2
SHA256 (fwknop-1.8.3.tar.gz) = 366dbb0c9ae38973cee960408eb1a76ed6ff544f15855affaed93331face9491
SIZE (fwknop-1.8.3.tar.gz) = 471949
@


1.1
log
@New port: security/fwknop fwknop,"FireWall KNock OPerator", implements
Single Packet Authorization (SPA).

	fwknop stands for the "FireWall KNock OPerator", and
	implements an authorization scheme called Single Packet
	Authorization (SPA). This method of authorization is based
	around a default-drop packet filter (fwknop supports both
	iptables on Linux systems and ipfw on FreeBSD and Mac OS X
	systems) and libpcap.

	SPA requires only a single encrypted packet in order to
	communicate various pieces of information including desired
	access through an iptables policy and/or complete commands
	to execute on the target system. By using iptables to
	maintain a "default drop" stance, the main application of
	this program is to protect services such as OpenSSH with
	an additional layer of security in order to make the
	exploitation of vulnerabilities (both 0-day and unpatched
	code) much more difficult. With fwknop deployed, anyone
	using nmap to look for sshd can't even tell that it is
	listening; it makes no difference if they have a 0-day
	exploit or not. The authorization server passively monitors
	authorization packets via libcap and hence there is no
	"server" to which to connect in the traditional sense.
	Access to a protected service is only granted after a valid
	encrypted and non-replayed packet is monitored from an
	fwknop client (see the following network diagram; the SSH
	session can only take place after the SPA packet is monitored):

PR:		ports/118229
Submitted by:	Sean Greven <sean.greven@@gmail.com>
@
text
@a0 1
MD5 (fwknop-1.8.3.tar.gz) = 9ee3ff46a01911a095f4cec9a3ca2e3b
@

