Search Results

Agent error code #PROX100 indicates that the ipset configured in the Knocknoc ACL does not exist on the Proxmox VE cluster (or on the configured VM, for per-VM scope). The cluster returned HTTP 404 when the agent looked it up. This error is distinct from autho...

Agent error code #PROX101 indicates that the agent reached Proxmox VE and the ipset lookup did not fail with a not-found or permission error, but the response could not be used to read the current ipset contents. This is distinct from #PROX100 (the ipset does ...

Agent error code #PROX102 indicates that the agent tried to add an IP address to the configured Proxmox VE ipset and Proxmox rejected the operation. The agent only adds and removes ipset entries. It does not create the ipset itself. If the ipset is missing the...

Agent error code #PROX103 indicates that the agent tried to remove an IP address from the configured Proxmox VE ipset and Proxmox rejected the operation. The agent only adds and removes ipset entries. If the ipset is missing the agent returns #PROX100 instead....

Agent error code #PROX104 indicates that, for a per-VM (qemu) scoped Knoc, Proxmox VE could not find the node or VM the agent was directed to. This applies only to per-VM scope. For cluster-scoped Knocs the agent does not target a node or VM, and a missing ips...

Agent error code #PROX400 indicates that the agent received a response from Proxmox VE that it could not parse as the expected ipset data. The request reached Proxmox, but the body was not in the form the agent expected. Common causes include: The backend URL...

Configure 1Kosmos as a SAML identity provider (IdP) for Knocknoc. Once connected, your users authenticate against 1Kosmos — including its biometric and passwordless factors — and Knocknoc maps their group membership to access entitlements. This example assumes...

Ping Identity SSO Configure PingOne as a SAML identity provider (IdP) for Knocknoc. Users authenticate against Ping, and Knocknoc maps their group membership to access entitlements. This example assumes your Knocknoc instance is at https://<tenant>.knoc.cloud....

IPsets with firewalld On RHEL-family hosts — and any distribution that uses firewalld as its firewall front-end — Knocknoc does not talk to firewalld directly. As with the main IPSet backend, Knocknoc orchestrates the kernel's native IPSets, and firewalld simp...

The Knocknoc OpenBSD Agent is orchestration software for managing just-in-time network access. It runs as the unprivileged _knocknoc-agent user, connects to your Knocknoc server over WebSocket, and enforces access locally through the configured integrations. ...

Knocknoc integrates with the PF packet filter to dynamically control network access on a host that the agent runs on directly. As users authenticate and grants expire, the agent adds and removes their IPs from a PF table; your own pass/block rules reference th...

Knocknoc normally grants access to the single IP a user authenticates from. Agentic Access and Companions extend that for two cases: granting time-limited access to an automated agent, and keeping access for a user's other companions, such as a second device o...

Knocknoc can orchestrate F5 Networks BigIP and related devices via two mechanisms, including iRules "Data group List" and the AFM. Typically iRules are used as they can be deployed across both high-end F5 devices and lower/smaller deployments. The iRules can r...

The Overview tab under Identities is the first thing you see when you open Identities in the admin interface. It gives you one place to see what your users, groups and admins have been doing recently, without opening each identity one at a time. Activity chart...

Agent error code #F5000 indicates that the Knocknoc agent could not establish a network connection to the F5 BIG-IP management endpoint at all. The connection failed before any authentication could take place. This is distinct from authentication (#F5001) and ...

Agent error code #F5001 indicates that the F5 BIG-IP rejected the username and password supplied by the Knocknoc agent. The device returned HTTP 401 Unauthorized when the agent tried to obtain an authentication token. This is distinct from authorization failur...

Agent error code #F5002 indicates that the F5 BIG-IP accepted the credentials but the user's role does not have permission to perform the requested operation on the data-group. The device returned HTTP 403 Forbidden. This is distinct from authentication failur...