Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's rather easy to configure knockd for ex.: on an Ubuntu server's (10.04) sshd:

# install knockd on the SERVER side
apt-get install knockd

vi /etc/default/knockd

# the default config file looks sexy
$ cat knockd.conf 

    sequence    = 7000,8000,9000
    seq_timeout = 5
    command     = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

    sequence    = 9000,8000,7000
    seq_timeout = 5
    command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

 * Usage: /etc/init.d/knockd {start|stop|restart|reload|force-reload}
/etc/init.d/knockd start
 * Starting Port-knock daemon knockd    [ OK ] 
netstat -tulpn | grep -i knockd
ps -ef | grep -i knockd
root     25069     1  0 11:44 ?        00:00:00 /usr/sbin/knockd -d 

# install knock on the CLIENT side
apt-get install knockd

# first disable the INPUT for port 22
iptables -I INPUT -p tcp --dport 22 -j DROP

# save your firewall rules if needed to be permanent
service iptables save

# try to connect without knocking: 
telnet 22

# knock on the SERVER from the CLIENT to open port for 22
knock -v 7000 8000 9000

# try to connect after knocking: 
telnet 22

It works, great..

QUESTION: But. If knocking means that we have to send packets to given ports, then shouldn't there be an "OPEN PORT" waiting for the knocking? How does it works? Does knockd gives more security? (I mean that SSHD is well audited, and I don't know about knockd.. )

share|improve this question
up vote 4 down vote accepted

ssh on port 22 is a well known port. If you leave port 22 open with ssh running on the internet and check your logs; you may see a couple thousand attempted entries a day (trying a variety of usernames).

knockd does not require a port being open or bound to a process while sshd requires the port being both open and bound to a process. knockd requires your router to forward packets sent to the specific ports to your server, but a software firewall can either drop (ignore; no response) or reject (send back icmp-port-unreachable or similar) the packets. Since knockd is just listening to your ethernet interface (and not examining the content of the packets in anything but the most superficial ways), it can detect that packets were sent to these closed ports without doing any additional processing on the packets that then get dropped by the software firewall (e.g., iptables).

So if you define a custom knock with say three ports randomly chosen; you've just added 48 bits of entropy (each port is between 0 and 216-1) before anyone can access your server. Granted; don't relax your security on sshd; as anyone sniffing traffic can observe your secret port knocking pattern and replay it; at which point they can start trying to attack sshd.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.