A knockd client for iPhone, iPad and Mac

What Secret Knock sends

Each step of a door is a TCP or UDP knock to one port, with an optional delay before it and, for UDP, an optional payload as text or hex. A TCP knock is one connection attempt: the app sends a single SYN and closes the attempt at once, so the operating system does not retransmit it — knockd 0.8 resets a sequence on a repeated SYN.

One-time sequences (knockd's one_time_sequences) work too: choose Knock type › One-time sequences and enter the list; after a knock that opened the door, Secret Knock moves on to the next sequence. Importing a knockd.conf does not read the sequence file — the import says so — so enter that list by hand.

Set up the server

A minimal knockd section that opens SSH for the knocking address for 10 seconds. Choose your own ports — never reuse published examples.

[options]
    UseSyslog

[openSSH]
    sequence      = 7311:tcp,8822:tcp,9133:udp
    seq_timeout   = 10
    tcpflags      = syn
    start_command = /usr/sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    cmd_timeout   = 10
    stop_command  = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

Add the door in the app

1. 1New door › Start from a template › knockd sample fills a three-port TCP sequence and SSH as the port to check; replace the ports with yours.
2. 2Or + › Import from file and pick your knockd.conf: each section with a sequence becomes a door.
3. 3Pin IPv4 or IPv6 for the door if your server's knockd listens on one family only.
4. 4Press and hold the brass knocker. The door shows Door ajar once port 22 answers, and Open SSH hands you to your SSH app.

Questions