Yes, that's right - you'd leave your public services open by default and the knock would simply open up tcp22 ...