{"id":2303,"date":"2021-07-20T23:33:34","date_gmt":"2021-07-20T23:33:34","guid":{"rendered":"https:\/\/dft.wiki\/?p=2303"},"modified":"2026-06-08T22:34:31","modified_gmt":"2026-06-09T02:34:31","slug":"using-port-knocking-to-secure-ssh-in-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=2303","title":{"rendered":"Using Port Knocking to Secure SSH in Ubuntu"},"content":{"rendered":"

Port Knocking<\/strong> allows you to open or close a remote port in a server’s firewall using a secret sequence of ports (with approximately 141 trillion possible combinations).<\/p>\n

It creates an extra layer of security for sensitive services such as SSH.<\/p>\n

\n

SERVER-SIDE<\/strong><\/p>\n

sudo apt update\r\nsudo apt install knockd -y\r\nsudo nano \/etc\/knockd.conf<\/pre>\n
Edit the configuration accordingly:<\/p>\n
[options]\r\n        UseSyslog\r\n\r\n[openSSH]\r\n        sequence    = 54321,12345,10101<\/strong><\/span>\r\n        seq_timeout = 5<\/strong><\/span>\r\n        command     = \/sbin\/iptables -A INPUT -s %IP%<\/span><\/strong> -p tcp --dport 22 -j ACCEPT\r\n        tcpflags    = syn\r\n\r\n[closeSSH]\r\n        sequence    = 12345,10101,54321<\/strong><\/span>\r\n        seq_timeout = 5<\/strong><\/span>\r\n        command     = \/sbin\/iptables -D INPUT -s %IP%<\/strong><\/span> -p tcp --dport 22 -j ACCEPT\r\n        tcpflags    = syn\r\n<\/pre>\n
Note: the port will only be open to connections from the %IP%<\/span><\/strong> that knocked with the correct sequence, remaining closed to everyone else. The timeout is set to 5<\/strong><\/span> seconds from the first to the last knock, with no other ports knocked in between.<\/p>\n
Then,<\/p>\n
sudo nano \/etc\/default\/knockd<\/pre>\n
Change the following:<\/p>\n
START_KNOCKD=1<\/strong>\r\n<\/pre>\n
Start the service.<\/p>\n
sudo systemctl start knockd\r\nsudo systemctl enable knockd\r\nsudo ufw enable\r\nsudo reboot<\/pre>\n
Ensure that port 22 is not open in the firewall.<\/p>\n
\n
CLIENT-SIDE<\/strong><\/p>\n
sudo apt update\r\nsudo apt install knockd -y<\/pre>\n
Send the knock sequence to open<\/span> the port:<\/p>\n
knock -v myserver.com 54321 12345 10101<\/strong> --delay 100<\/strong><\/span><\/span><\/pre>\n
Send the knock sequence to close<\/span> the port:<\/p>\n
knock -v myserver.com 12345 10101 54321<\/strong> --delay 100<\/strong><\/span><\/span><\/pre>\n
Note: a delay of 100<\/strong> milliseconds is recommended because packets may arrive out of order depending on the route they take.<\/p>\n
The sequence can also be sent using telnet:<\/p>\n
timeout 0.1 telnet myserver.com 54321<\/strong><\/span> ; timeout 0.1 telnet myserver.com 12345<\/strong><\/span> ; timeout 0.1 telnet myserver.com 10101<\/strong><\/span>\r\ntimeout 0.1 telnet myserver.com 12345<\/strong><\/span> ; timeout 0.1 telnet myserver.com 10101<\/span><\/strong> ; timeout 0.1 telnet myserver.com 54321<\/strong><\/span><\/pre>\n
\n
AUTHENTICATED PORT KNOCKING<\/strong><\/p>\n
LetMeIn offers authenticated port knocking with a simple authentication mechanism [Link<\/a>].<\/p>\n
Note:<\/strong> it requires nftables<\/code> (not compatible with iptables<\/code>) and the Rust toolchain. Encryption is based on a symmetric pre-shared key.<\/p>\n
Build and install on the Server<\/strong>.<\/p>\n
sudo apt update\r\nsudo apt install git cargo build-essential -y\r\ngit clone https:\/\/github.com\/mbuesch\/letmein.git\r\ncd letmein\r\ncargo build --release --bin letmeind\r\nsudo cp target\/release\/letmeind \/usr\/local\/bin\/ \r\nsudo mkdir -p \/etc\/letmein \r\nsudo cp install-server.sh \/etc\/letmein\/\r\nsudo nano \/etc\/systemd\/system\/letmeind.service<\/pre>\n
Add the following content.<\/p>\n
[Unit]\r\nDescription=Letmein port-knocking daemon\r\nAfter=network.target\r\n\r\n[Service]\r\nExecStart=\/usr\/local\/bin\/letmeind -c \/etc\/letmein\/letmeind.conf\r\nRestart=on-failure\r\n\r\n[Install]\r\nWantedBy=multi-user.target\r\n<\/pre>\n
Start the service.<\/p>\n
sudo systemctl daemon-reload\r\nsudo systemctl enable --now letmeind\r\n<\/pre>\n
Configure nftables<\/code>.<\/p>\n
sudo apt install nftables\r\nsudo systemctl enable --now nftables\r\nsudo nano \/etc\/nftables\/letmein.conf<\/pre>\n
The following is an example for reference and should be tailored to your system’s requirements.<\/p>\n
table inet filter {\r\n  chain input {\r\n    type filter hook input priority 0; policy drop;\r\n    iif \"lo\" accept\r\n    ct state established,related accept\r\n\r\n    # jump to letmein chain\r\n    jump letmein-input\r\n  }\r\n\r\n  chain letmein-input {\r\n    # LetMeIn will insert rules here to allow per-IP access to protected resources.\r\n    # Defines the default to reject\r\n    tcp dport 22 reject\r\n  }\r\n}\r\n<\/pre>\n
Apply the rules.<\/p>\n
sudo nft -f \/etc\/nftables\/letmein.conf\r\nsudo systemctl restart nftables<\/pre>\n
Notify LetMeIn of the new rule set.<\/p>\n
sudo nano \/etc\/letmein\/letmeind.conf<\/pre>\n
The content below is an example that will need to be updated once the client shares its key.<\/p>\n
[KEYS]\r\n00000000 = \"PLACE_HOLDER_SECRET_KEY\"\r\n\r\n[RESOURCES]\r\n00000022 = \"port:22\"<\/pre>\n
On the Client<\/strong> side, after installing LetMeIn, generate a key (secret + user ID).<\/p>\n
letmein gen-key -u 00000000<\/pre>\n
    \n
  1. Copy the output (key) to \/etc\/letmein\/letmein.conf<\/code> or ~\/.config\/letmein\/<\/code><\/li>\n
  2. Paste the same key into the Server<\/strong> configuration.<\/li>\n<\/ol>\n
    Then test knocking and connecting to the service.<\/p>\n
    letmein knock -u 00000000 server.example.com 22\r\nssh user@server.example.com<\/pre>\n
    \n
    BONUS<\/strong><\/p>\n
    Automate port knocking in the SSH workflow.<\/p>\n
    nano ~\/.ssh\/config<\/pre>\n
    Host server\r\n  HostName server.example.com\r\n  ProxyCommand bash -c \"letmein knock -u 00000000 %h 22; nc %h %p\"\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
    Port Knocking allows you to open or close a remote port in a server’s firewall […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,6],"tags":[],"class_list":["post-2303","post","type-post","status-publish","format-standard","hentry","category-linux","category-raspberry-pi"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2303"}],"version-history":[{"count":9,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2303\/revisions"}],"predecessor-version":[{"id":5719,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2303\/revisions\/5719"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}