Search Results

Groups in Knocknoc map users to Knocs, and a user can belong to multiple groups. To create a group: In the Knocknoc admin interface, open Identities, select the Groups tab, and click Create Group. Enter a Name. For SAML and Dynamic groups this must match the g...

For additional security and temporal access control, Knocs support a "click to grant" and "click to revoke" option. This requires the user to click a button after logging in, prior to each grant being processed. This offers an additional layer of security and ...

Admins in Knocknoc can log in to /admin on their Knocknoc server, however they can't be granted ACLs. This separates out regular logins from admin logins, and allows for best practice. You can create an Admin using this dialog box if required. SAML is the pref...

The Settings page is where administrators configure how Knocknoc behaves across the whole deployment: sign-in methods, the server's public address, TLS certificates, logging, threat intelligence, optional access features, and branding. It is only available to ...

NTP It's important that ALL the servers within the Knocknoc cluster and agents are synchronized and set to the correct time.  We recommend using chrony on a Linux VM to keep the time, but any NTP implementation would work. Time is an important aspect of authen...

The Knocknoc server will need to be able to contact your LDAP server on port 389 or 636. This is determined by the LDAP URL in the Settings: ldap://myldap.domain.com - this format says port 389 ldaps://myldap.domain.com - this format is port 636 Please make...

Running Knocknoc behind HAProxy could be a great option for people with existing HAProxy deployments, or who want to unify certificate and other management tasks. Here is a sample HAProxy config for Knocknoc as a backend: frontend Sol1-Frontend bind 0.0.0...

Cloud SaaS or self-hosted server? You can run your Knocknoc server either as a managed cloud instance (we host it) or you can self-host it. Should I deploy a cloud or self-hosted instance of Knocknoc? The answer will depend on a few factors. For example, if yo...

This is an example that lets you use Shorewall https://shorewall.org/index.html and IPsets to dynamically allowlist IPs. You can achieve great power with these simple steps: Install the Knocknoc Agent on the Shorewall host and enroll it into the Knocknoc serv...

Checking to see if an ACL is present in HAProxy For when you aren't sure if the whole process is working, you can manually connect to the HAProxy socket and print out the contents. socat is the way forward here. Install it with your favorite package manager, a...

Users sign in and get access to your infrastructure through the Knocs and groups assigned to them. This page covers the types of user you can create, when to use each, and how to create them. Admin accounts are managed separately, on the Admins tab. This page ...

Knocknoc can drive an nginx server's allow/deny list directly from the agent, without a wrapper script. Users authenticated by Knocknoc are added to a per-Knoc include file (for example /etc/nginx/acl/librenms.acl) that the agent rewrites atomically, then rel...

Apache 2.4 and above have slightly different ACL syntax, so this page covers how you can use Knocknoc to manage ACLs. The script for managing Apache ACLs as per this document was added to knocknoc-agent in version 1.0.31 Setup for your Apache webserver SSH to ...

G Suite can be set up as an Identity Provider if you have G Suite Business Starter or above plan. The basis of this guide is the official docs here: https://support.google.com/a/answer/6087519?hl=en which should be referred to in case anything changes from the...

Knocknoc integrates with Microsoft Entra ID (formerly Azure AD) to dynamically control which IPs are allowed to sign in through Conditional Access. The integration uses the Microsoft Graph API to maintain a single IP Named Location. As users authenticate to Kn...

Azure Portal or specific Azure services can be further protected through the use of the Knocknoc Entra back end. This helps prevent or reduce ransomware and common Business Email Compromise (BEC) attacks and data theft/exfiltration through isolating user login...

Ivanti Connect Secure devices that have an outer firewall or control layer can be protected from unauthorized threat actors by implementing Knocknoc and firewall orchestration. This prevents direct internet access to the Ivanti Connect Secure devices prior to ...

Protect your existing Fortigate or Palo Alto assets from direct internet or internal exposure by introducing Knocknoc. Remote management and administration interfaces, VPN services/ports or any service offered can be protected, requiring a centralized login pr...