knockd(1) knockd(1) (NAME) knockd - ( ) (SYNOPSIS) knockd [] (DESCRIPTION) knockd (port-knock) . ( PPP) <<>> (knock) . TCP ( UDP) . -- knockd (link-layer) . . . (OPTIONS) -i, --interface . eth0 . -d, --daemon . . -c, --config . /etc/knockd.conf . -D, --debug (). -l, --lookup (DNS) . ! (SECURITY NOTES) . -4, --only-ip-v4 IPv6 IPv4. -v, --verbose . -V, --version . -h, --help . (CONFIGURATION) knockd / . / [name] name . [options] . : . (SSH) . ( DENY) . [options] logfile = /var/log/knockd.log [openSSH] sequence = 7000,8000,9000 seq_timeout = 10 tcpflags = syn command = /usr/sbin/iptables -A INPUT -s %IP% --dport 22 -j ACCEPT [closeSSH] sequence = 9000,8000,7000 seq_timeout = 10 tcpflags = syn command = /usr/sbin/iptables -D INPUT -s %IP% --dport 22 -j ACCEPT : (SSH) . start_command cmd_timeout stop_command . . UDP TCP . [options] logfile = /var/log/knockd.log [opencloseSSH] sequence = 2222:udp,3333:tcp,4444:udp seq_timeout = 15 tcpflags = syn,ack start_command = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --syn -j ACCEPT cmd_timeout = 5 stop_command = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --syn -j ACCEPT : ( ) one_time_sequences . . (Replay Attack) . [options] logfile = /var/log/knockd.log [opencloseSMTP] one_time_sequences = /etc/knockd/smtp_sequences seq_timeout = 15 tcpflags = fin,!ack start_command = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 25 -j ACCEPT cmd_timeout = 5 stop_command = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 25 -j ACCEPT : IPv4 IPv6. . [options] logfile = /var/log/knockd.log [opencloseSMTP] one_time_sequences = /etc/knockd/smtp_sequences seq_timeout = 15 tcpflags = fin,!ack start_command = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 25 -j ACCEPT start_command_6 = /usr/sbin/ip6tables -A INPUT -s %IP% -p tcp --dport 25 -j ACCEPT cmd_timeout = 5 stop_command = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 25 -j ACCEPT stop_command_6 = /usr/sbin/ip6tables -D INPUT -s %IP% -p tcp --dport 25 -j ACCEPT : (CONFIGURATION: GLOBAL DIRECTIVES) UseSyslog ()syslog. /var/log/messages . LogFile = /path/to/file /var/log/knockd.log. PidFile = /path/to/file PID : /var/run/knockd.pid. Interface = . ( "eth0" "/dev/eth0"). : eth0. : / (CONFIGURATION: KNOCK/EVENT DIRECTIVES) Sequence = [:],[:][,[:] ...] . . ( TCP ). One_Time_Sequences = /path/to/one_time_sequences_file . knockd . '#' . . '#' (space) '#' . Sequence . '#' . : knockd ! Seq_Timeout = . . TCPFlags = fin|syn|rst|psh|ack|urg . TCP knockd TCP . . "TCPFlags = syn" SSH SSH . ( TCPFlags = syn,ack,urg). "!" ( TCPFlags = syn,!ack). Target = IP Interface Sequence. knockd -- etherwake WOL . Start_Command = IPv4 . %IP% IP . Command Start_Command . Start_Command_6 = IPv6 . %IP% IP . Command_6 Start_Command_6 . Start_Command IPv4 . . Cmd_Timeout = ( ) Start_Command Stop_Command. Stop_Command . Stop_Command = Cmd_Timeout Start_Command . %IP% IP . . Stop_Command_6 = Cmd_Timeout Start_Command_6 . %IP% IP . . Stop_Command IPv4 . . (SECURITY NOTES) -l --lookup (DNS) ! DNS knockd . ( ACK+RST TCP ) () DNS . (SEE ALSO) knock telnet netcat TCP . hping sendip packit . (AUTHOR) Judd Vinet knockd 0.8 April 22, 2021 knockd(1)