←back to thread

Knocker, a knock based access control system for your homelab

(github.com)
67 points xlmnxp | 2 comments | 22 Oct 25 08:37 UTC | HN request time: 0.416s | source
1. parliament32 ◴[22 Oct 25 20:28 UTC] No.45674733[source]▶
The "port knocking" has surfaced often since the early 2000s, but it continues to be a rather silly exercise in making security-by-obscurity look more complicated while not really helping all that much.

Briefly looking at the diagram at the top of the repo, it looks like you "knock" with an API key. Why not just run a reverse proxy in front of (whatever service you're trying to protect) and use the API keys there? To harden further, do some sort of real authentication (PKI, client certs). If you want your logs to look cleaner, install and actually configure fail2ban.

replies(1): >>45676726 #
2. fariszr ◴[23 Oct 25 00:09 UTC] No.45676726[source]▶
> Why not just run a reverse proxy in front of (whatever service you're trying to protect) and use the API keys there?

Because it breaks the clients of most homelab services.

That's what authelia does.