0

In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over the specific port(s). A variant called single packet authorization exists, where only a single "knock" is needed, consisting of an encrypted packet.

The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan because unless the attacker sends the correct knock sequence, the protected ports will appear closed.

source: https://en.wikipedia.org/wiki/Port_knocking

During a discussion, I came up with the following question: Considering an admin (as in server admin) or even an attacker (as in the bad guy trying to get access to the machine) a port knocking method can be considered a form of authentication towards that server?

5
  • please cite your sources when copy/pasting someone else's words
    – schroeder
    Sep 27, 2018 at 18:55
  • 2
    In no way does port knocking verify the identity of anything, so I'm not sure why "authentication" came to mind when thinking about port knocking. Can you explain your thinking on that?
    – schroeder
    Sep 27, 2018 at 18:57
  • @schroeder thanks for the feedback. Because you use something you know (or can find) to get access to something. It's only validating a thing you know. Sep 27, 2018 at 19:54
  • That's not an identification process.
    – schroeder
    Sep 27, 2018 at 20:34
  • 2
    You could consider port knocking to be the same level of authentication as yelling your password in a crowd. It works great the first time! After first use, not only have you given it up, you've gone out of your way to attract attention. Sep 27, 2018 at 22:14

1 Answer 1

1

The basics IAAA defines Identification, Authentication, Authorization and Accountability.

Authentication could become to mind because is something I know, the order of the ports to knock, but is not authenticating and identity. So I think this is not authentication.

In the other hand, Authorization is more from a policy or rule. So I think this is more like authorization. If you know the knock, you can come in.

I imagine a similar situation in the real world, if you have a key to a door, you are authorized to get in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .