In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over the specific port(s). A variant called single packet authorization exists, where only a single "knock" is needed, consisting of an encrypted packet.

The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan because unless the attacker sends the correct knock sequence, the protected ports will appear closed.

source: https://en.wikipedia.org/wiki/Port_knocking

During a discussion, I came up with the following question: Considering an admin (as in server admin) or even an attacker (as in the bad guy trying to get access to the machine) a port knocking method can be considered a form of authentication towards that server?

  • please cite your sources when copy/pasting someone else's words – schroeder Sep 27 at 18:55
  • 2
    In no way does port knocking verify the identity of anything, so I'm not sure why "authentication" came to mind when thinking about port knocking. Can you explain your thinking on that? – schroeder Sep 27 at 18:57
  • @schroeder thanks for the feedback. Because you use something you know (or can find) to get access to something. It's only validating a thing you know. – Lucian Nitescu Sep 27 at 19:54
  • That's not an identification process. – schroeder Sep 27 at 20:34
  • 1
    You could consider port knocking to be the same level of authentication as yelling your password in a crowd. It works great the first time! After first use, not only have you given it up, you've gone out of your way to attract attention. – user10216038 Sep 27 at 22:14
up vote 1 down vote accepted

The basics IAAA defines Identification, Authentication, Authorization and Accountability.

Authentication could become to mind because is something I know, the order of the ports to knock, but is not authenticating and identity. So I think this is not authentication.

In the other hand, Authorization is more from a policy or rule. So I think this is more like authorization. If you know the knock, you can come in.

I imagine a similar situation in the real world, if you have a key to a door, you are authorized to get in.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.