head	1.2;
access;
symbols
	RELEASE_8_3_0:1.1
	RELEASE_9_0_0:1.1
	RELEASE_7_4_0:1.1
	RELEASE_8_2_0:1.1
	RELEASE_6_EOL:1.1
	RELEASE_8_1_0:1.1
	RELEASE_7_3_0:1.1
	RELEASE_8_0_0:1.1
	RELEASE_7_2_0:1.1
	RELEASE_7_1_0:1.1
	RELEASE_6_4_0:1.1;
locks; strict;
comment	@# @;


1.2
date	2012.11.28.00.11.25;	author svnexp;	state dead;
branches;
next	1.1;

1.1
date	2008.06.13.03.43.51;	author edwin;	state Exp;
branches;
next	;


desc
@@


1.2
log
@## SVN ##
## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/ 307863
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ## r307863 | rakuco | 2012-11-27 21:41:29 +0000 (Tue, 27 Nov 2012) | 11 lines
## SVN ##
## SVN ## Update to 2.0.3.
## SVN ##
## SVN ## This new version includes a migration from Perl to C and support for
## SVN ## ipfw and pf.
## SVN ##
## SVN ## While here, trim the Makefile headers.
## SVN ##
## SVN ## PR:		ports/171951
## SVN ## Submitted by:	Sean Greven <sean.greven@@gmail.com> (maintainer)
## SVN ## Feature safe:	yes
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ##
@
text
@--- fwknopd.orig       2007-11-21 20:59:13.000000000 +0200
+++ fwknopd    2007-11-21 21:02:31.000000000 +0200
@@@@ -40,7 +40,7 @@@@
 # $Id: fwknopd 583 2006-11-04 20:43:01Z mbr $
 #
 
-use lib '/usr/lib/fwknop';
+use lib '%%PREFIX%%/lib/fwknop';
 use Crypt::CBC;
 use Unix::Syslog qw(:subs :macros);
 use Net::IPv4Addr qw(ipv4_in_network);
@@@@ -59,7 +59,7 @@@@
 use Getopt::Long;
 use strict;
 
-my $config_file = '/etc/fwknop/fwknop.conf';
+my $config_file = '%%PREFIX%%/etc/fwknop/fwknop.conf';
 
 my $version = '1.8.3';
 my $revision_svn = '$Revision: 809 $';
@


1.1
log
@New port: security/fwknop fwknop,"FireWall KNock OPerator", implements
Single Packet Authorization (SPA).

	fwknop stands for the "FireWall KNock OPerator", and
	implements an authorization scheme called Single Packet
	Authorization (SPA). This method of authorization is based
	around a default-drop packet filter (fwknop supports both
	iptables on Linux systems and ipfw on FreeBSD and Mac OS X
	systems) and libpcap.

	SPA requires only a single encrypted packet in order to
	communicate various pieces of information including desired
	access through an iptables policy and/or complete commands
	to execute on the target system. By using iptables to
	maintain a "default drop" stance, the main application of
	this program is to protect services such as OpenSSH with
	an additional layer of security in order to make the
	exploitation of vulnerabilities (both 0-day and unpatched
	code) much more difficult. With fwknop deployed, anyone
	using nmap to look for sshd can't even tell that it is
	listening; it makes no difference if they have a 0-day
	exploit or not. The authorization server passively monitors
	authorization packets via libcap and hence there is no
	"server" to which to connect in the traditional sense.
	Access to a protected service is only granted after a valid
	encrypted and non-replayed packet is monitored from an
	fwknop client (see the following network diagram; the SSH
	session can only take place after the SPA packet is monitored):

PR:		ports/118229
Submitted by:	Sean Greven <sean.greven@@gmail.com>
@
text
@@

