In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over the specific port(s). A variant called single packet authorization exists, where only a single "knock" is needed, consisting of an encrypted packet.

The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan because unless the attacker sends the correct knock sequence, the protected ports will appear closed.

source: https://en.wikipedia.org/wiki/Port_knocking

During a discussion, I came up with the following question: Considering an admin (as in server admin) or even an attacker (as in the bad guy trying to get access to the machine) a port knocking method can be considered a form of authentication towards that server?

  • please cite your sources when copy/pasting someone else's words – schroeder Sep 27 '18 at 18:55
  • 2
    In no way does port knocking verify the identity of anything, so I'm not sure why "authentication" came to mind when thinking about port knocking. Can you explain your thinking on that? – schroeder Sep 27 '18 at 18:57
  • @schroeder thanks for the feedback. Because you use something you know (or can find) to get access to something. It's only validating a thing you know. – Lucian Nitescu Sep 27 '18 at 19:54
  • That's not an identification process. – schroeder Sep 27 '18 at 20:34
  • 1
    You could consider port knocking to be the same level of authentication as yelling your password in a crowd. It works great the first time! After first use, not only have you given it up, you've gone out of your way to attract attention. – user10216038 Sep 27 '18 at 22:14

The basics IAAA defines Identification, Authentication, Authorization and Accountability.

Authentication could become to mind because is something I know, the order of the ports to knock, but is not authenticating and identity. So I think this is not authentication.

In the other hand, Authorization is more from a policy or rule. So I think this is more like authorization. If you know the knock, you can come in.

I imagine a similar situation in the real world, if you have a key to a door, you are authorized to get in.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.