How does knockd work?

Question

It's rather easy to configure knockd for ex.: on an Ubuntu server's (10.04) sshd:

========================================================================
0)
# install knockd on the SERVER side
apt-get install knockd

========================================================================
1)
# 
vi /etc/default/knockd
START_KNOCKD=1

========================================================================
2)
# the default config file looks sexy
$ cat knockd.conf 
[options]
    UseSyslog

[openSSH]
    sequence    = 7000,8000,9000
    seq_timeout = 5
    command     = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

[closeSSH]
    sequence    = 9000,8000,7000
    seq_timeout = 5
    command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

========================================================================
3)
/etc/init.d/knockd
 * Usage: /etc/init.d/knockd {start|stop|restart|reload|force-reload}
/etc/init.d/knockd start
 * Starting Port-knock daemon knockd    [ OK ] 
netstat -tulpn | grep -i knockd
ps -ef | grep -i knockd
root     25069     1  0 11:44 ?        00:00:00 /usr/sbin/knockd -d 

========================================================================
4)
# install knock on the CLIENT side
apt-get install knockd

========================================================================
5)
# first disable the INPUT for port 22
iptables -I INPUT -p tcp --dport 22 -j DROP

# save your firewall rules if needed to be permanent
service iptables save

========================================================================
6)
# try to connect without knocking: 
telnet 1.2.3.4 22

# knock on the SERVER from the CLIENT to open port for 22
knock -v 1.2.3.4 7000 8000 9000

# try to connect after knocking: 
telnet 1.2.3.4 22
========================================================================

It works, great..

QUESTION: But. If knocking means that we have to send packets to given ports, then shouldn't there be an "OPEN PORT" waiting for the knocking? How does it works? Does knockd gives more security? (I mean that SSHD is well audited, and I don't know about knockd.. )

Answer 1

ssh on port 22 is a well known port. If you leave port 22 open with ssh running on the internet and check your logs; you may see a couple thousand attempted entries a day (trying a variety of usernames).

knockd does not require a port being open or bound to a process while sshd requires the port being both open and bound to a process. knockd requires your router to forward packets sent to the specific ports to your server, but a software firewall can either drop (ignore; no response) or reject (send back icmp-port-unreachable or similar) the packets. Since knockd is just listening to your ethernet interface (and not examining the content of the packets in anything but the most superficial ways), it can detect that packets were sent to these closed ports without doing any additional processing on the packets that then get dropped by the software firewall (e.g., iptables).

So if you define a custom knock with say three ports randomly chosen; you've just added 48 bits of entropy (each port is between 0 and 2¹⁶-1) before anyone can access your server. Granted; don't relax your security on sshd; as anyone sniffing traffic can observe your secret port knocking pattern and replay it; at which point they can start trying to attack sshd.