مكتبة الشروحات

Port knocking adds an extra layer of obscurity to SSH access — the SSH port stays closed to everyone until a specific sequence of connection attempts ("knocks") on other ports is received, at which point it opens briefly for the knocking IP.

What Port Knocking Adds (and Doesn't)

Port knocking is a form of security through obscurity — it doesn't replace strong authentication (SSH keys, disabled password auth) but adds a layer that hides SSH from casual port scans and automated brute-force attempts targeting the open port directly.

Prerequisites

• SSH already secured with key-based authentication (see How to Secure SSH: Key-Based Authentication & Disabling Root Login)
• UFW or iptables configured

Step 1 — Install knockd

sudo apt install knockd -y

Step 2 — Configure the Knock Sequence

sudo nano /etc/knockd.conf

[options]
    UseSyslog

[openSSH]
    sequence    = 7000,8000,9000
    seq_timeout = 5
    command     = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

[closeSSH]
    sequence    = 9000,8000,7000
    seq_timeout = 5
    command     = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

Choose your own unique port sequence rather than these example values.

Step 3 — Block SSH by Default

sudo ufw deny 22/tcp

SSH is now closed to everyone until the correct knock sequence is received.

Step 4 — Configure knockd to Start on Boot

sudo nano /etc/default/knockd

START_KNOCKD=1
KNOCKD_OPTS="-i eth0"

sudo systemctl enable --now knockd

Step 5 — Perform a Knock from the Client

sudo apt install knockd -y  # provides the client-side knock command
knock YOUR_SERVER_IP 7000 8000 9000
ssh user@YOUR_SERVER_IP

Step 6 — Close the Port After Use (Optional)

knock YOUR_SERVER_IP 9000 8000 7000

Important Caution: Maintain Alternative Access

Before fully relying on port knocking, ensure you have your hosting provider's console/KVM access available as a fallback — a misconfiguration in the knock sequence or firewall rule could lock you out entirely.

Limitations to Understand

• The knock sequence itself could theoretically be observed if someone captures your traffic (though this is a fairly narrow attack window)
• Not a substitute for strong authentication — combine with, never replace, SSH key-based auth
• Adds friction to your own legitimate access, a trade-off against the obscurity benefit

Common Errors

Knock doesn't open the port — verify the sequence, timing (seq_timeout), and that knockd is actually running and monitoring the correct interface.

Locked out after enabling — use your provider's console access to review and correct the configuration; this is exactly why maintaining console access before relying on port knocking matters.

Best Practices

• Always verify console/KVM access works before blocking SSH by default
• Use port knocking as a supplementary layer, never as your only security measure
• Document your knock sequence securely — losing it means losing convenient access

Continue Reading

• How to Secure SSH: Key-Based Authentication & Disabling Root Login
• How to Harden a Fresh Linux VPS in 15 Minutes
• How to Configure UFW (Uncomplicated Firewall) on Ubuntu & Debian

Browse more articles in Advanced Networking & VPN.