said by nwrickert :

However, most inexpensive broadband routers are not suitable. So this is mostly a geek technique, particularly for those enthralled by the gee-whiz nature of the methodology.

So if a security layer doesn't work on "inexpensive broadband routers" then it's essentially a toy technology?

However, most inexpensive broadband routers are not suitable. So this is mostly a geek technique, particularly for those enthralled by the gee-whiz nature of the methodology.

Does this help?

whose rules can be dynamically modified.

So, yeah...it's just one port, man. Does this change anything for you?

said by nwrickert :

But why port knocking?

Couldn't you achieve the same thing with a udp listener that can open the firewall for a particular connection in response to an encrypted and digitally signed udp packet? It seems to me that this would be more effective and simpler to implement. Moreover, it would work behind a NAT router, where I would only have to forward that one udp port instead of all of the ports that would be needed for port knocking.

said by Sebastien Jeanquier :

"In broad terms, port knocking is a method for transmitting information across closed ports, with the aim of authenticating users before allowing them, and only them, to access a protected service.."

said by Sebastien Jeanquier :

The knock daemon has the ability to read knocks out of the firewall log, or directly off of the wire using libpcap. Due to the way that this implementation deals directly with the bit-representation of the knocked ports, it would be quite difficult to compromise the daemon itself with maliciously crafted packets.

said by Daniel :

Holy God. You mean you've been arguing all this time against it and you don't even know how it works?

Portknocking only opens ONE (1) port, e.g. 22 for SSH.

Moreover, it would work behind a NAT router, where I would only have to forward that one udp port instead of all of the ports that would be needed for port knocking.

Based on what I've read here, it appears that portknocking can be a useful part of an SSH implementation.

Millions of people do have access to my SSH daemon. So far that hasn't been a problem.

If we're trying to address the problem of millions of people having access to your SSH daemon, the way to counter that is with a network-based control.

... I was thinking more along the lines of a port being accessible by everyone whenever a single user entered the correct port sequence for access. Obviously I forgot that iptables can allow access to ports on a per IP address after a port knocking sequence. Hence, my previous questions do not apply. So it's possible to have thousands of users access a service remotely, but no indication to others that a remote service is listening on a certain port.

said by EGeezer :

Based on what I've read here, it appears that portknocking can be a useful part of an SSH implementation. While there were several general non-technical analogies presented, none seemed to address the methods a hacker might use to discover and obtain the port knocking sequence in a public network.

I was hoping to see an answer to the scenario I referenced in my earlier post, but that appears not to be forthcoming. Perhaps there is no practical way.

One question, though - how would one build an IP table for the IP authorization if the clients are road warriors using DHCP? Seems that option would not be useful in that case.