Alessio Cassibba (x-drum)

Alessio Cassibba (x-drum)



8,345 latest version

1.5 quality score

Version information

  • 0.0.4 (latest)
  • 0.0.3
  • 0.0.2
  • 0.0.1
released Jul 3rd 2019

Start using this module


xdrum/knockd — version 0.0.4 Jul 3rd 2019


This module manages knockd.

Class: knockd

A class for managing knockd server options


package name.

service name (initscript name).

log action messages through syslog().

log actions directly to a file, (defaults to: /var/log/knockd.log).

pidfile to use when in daemon mode, (defaults to: /var/run/

[interface]: network interface to listen on (mandatory).


 class { "knockd":
   interface => 'eth0',

Define: knockd::sequence

A defined type for managing knockd sequences


port sequence used in single knock mode.

port sequence used in the open knock (two knock mode).

port sequence used in the close knock (two knock mode).

file containing the one time sequences to be used. (instead of using a fixed sequence).

port sequence timeout.

only pay attention to packets that have this flag set.

command executed when a client makes a correct port knock (both modes).

command executed when cmd_timeout seconds are passed or when a close sequence was received (both modes).

time to wait between start and stop command (only required in two knock mode).


An Open/Close example that uses a single knock to control access to port 22(ssh):

 class { "knockd":
   interface => 'eth3',
 knockd::sequence {
     sequence      => '2222:udp,3333:tcp,4444:udp',
     seq_timeout   => '15',
     tcpflags      => 'syn,ack',
     start_command => '/usr/sbin/iptables -A INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',
     cmd_timeout   => '10',
     stop_command  => '/usr/sbin/iptables -D INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',

An example using two knocks: the first allow access to port 22(ssh), the second will close the port:

 class { "knockd":
   interface => 'eth0',
 knockd::sequence {
     open_sequence      => '7000,8000,9000',
     close_sequence     => '9000,8000,7000',
     seq_timeout        => '10',
     tcpflags           => 'syn',
     start_command      => '/usr/sbin/iptables -A INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',
     stop_command       => '/usr/sbin/iptables -D INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',


Copyright 2015 Alessio Cassibba (X-Drum), unless otherwise noted.