Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

By robust and low-hassle I mean NOT involving complex iptables setups, NOT involving apache, NOT requiring an additional client program, NOT requiring fragile shell scripts running from cron, etc.

Does anybody have sshd & ssh (client) patches to enable some form of port-knocking built-in to the sshd service & client itself?

For instance, rejecting connections on Port 22 until a properly encrypted and verified UDP packet is received, would be nice.

I'm disappointed that all port-knocking solutions out there are shameless hacks, rather than a nicely integrated and tested patch to the programs in question.

share|improve this question
up vote 5 down vote accepted

knockd seems to be one of the more established implementations, although doesn't fit your criteria of being a patch to sshd itself. Personally I'd favour an external program for reasons including:

  • it can be used to help secure other services (e.g. IMAP, OpenVPN) as well as ssh
  • patching extra functionality into sshd increases likelihood of introducing vulnerabilities (no matter how "tested" such a patch may be, sshd runs as root so the smallest flaw could prove to be quite nasty)
share|improve this answer
+1 for not patching core system daemons and keeping separate functionality... well, separate. – womble Nov 22 '09 at 0:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.