Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was just referring to this article: http://en.wikipedia.org/wiki/Port_knocking
The term Port Knocking, as explained here, was slightly confusing and I was feeling difficulty in getting the hang of it. I would be really thankful if anyone could offer a simpler explanation.
Let's say you want to be able to SSH into your server from anywhere. But you find that if you leave SSH listening on port 22, systems all over the Internet are regularly trying to log into it and filling up your logs with auth failures. You are offended by this.
So you set up port knocking.
Your firewall blocks access to port 22 - but if packets come for ports 1234 and 5678 in the space of one minute, your firewall will open access to port 22 for a brief window. Therefore, your SSH server is safe from random people (who won't know how to "knock" to open the port) but you can get in whenever you want by sending a couple of special packets before connecting.
In this scenario, ports 1234 and 5678 aren't listening, there's no service running there - the special bit is that the firewall notices attempts to reach those ports and does something accordingly.
As security goes, this is minor; it's a form of security through obscurity, and only offers incremental benefits. It can be useful in cutting down noise from automated attackers, though.
Think of port knocking as a combination lock. In order to open a combination lock you have to input the correct sequence of numbers. Port knocking works the same way: a system will attempt to connect to a sequence of TCP or UDP ports, if the correct sequence is sent the firewall will allow some sort of connectivity for that system.
Port knocking has the same vulnerabilities as a combination lock as well. Both can be observed, and the combination seen. Also, both are vulnerable to brute force attacks.
Port knocking is an interesting idea, I've never seen an actual implementation of it though. It's much simpler to allow connectivity based on some sort of authentication like a username/password or two-factor authentication.
This is such a broad question. What is it you are trying to accomplish. For example, most individuals I have come across try to use port knocking to minimize (rid themselves) of SSH brute force attacks. For these types of attacks, I recommend using Duo since its dual factor versus security through obscurity (port knocking).
The overall gist of port knocking is based on the premise of a "secret." "No one will ever know I have the keys to my house, hidden under a rock, 10 feet to the left of my door, in the yard, under the green garbage can, not the blue one" The secret is not really a secret because it is there for everyone to find, if someone wants to look hard enough. So what are you trying to accomplish/protect?
