// the take
knockknock is a minimal port-knocking tool from Moxie Marlinspike: a daemon that tails kern.log for a single crypto-encoded SYN packet and opens a firewall rule for the sender, plus a client to send that packet and a SOCKS proxy mode for tunneling through it. It's for people who want to hide an SSH or admin port behind something stealthier than a static firewall rule, without running an extra network service to do it.
The design avoids adding attack surface: the daemon never binds a socket or uses libpcap, it just reads iptables LOG lines out of kern.log, so there's no new listening service to exploit. The knock itself is a single SYN packet encrypted with AES-CTR and authenticated with HMAC in an authenticate-then-encrypt order, which beats the classic knock-sequence replay problem outright. Privilege separation is taken seriously — the code that actually needs root to touch iptables is isolated to roughly 15 lines, with everything else forked off and de-privileged. The included SOCKS proxy mode is a nice extra: you get a knock-gated tunnel, not just a single opened port.
No commits since 2018 — for a tool that's directly handling crypto and firewall rules, eight years of silence means no one has revisited the HMAC-SHA1 construction or fixed anything that's since broken against current kernels or iptables versions. It's hard-wired to iptables' LOG target and kern.log text parsing, so it won't work on nftables-only hosts or any system where syslog routing doesn't dump kernel log lines where it expects them. The codebase shows no sign of Python 3 support, so getting it running on a modern distro likely means porting it yourself first. There's also no story for key rotation or revocation if a client's shared secret leaks — you'd be redistributing new keys by hand.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →