"Expanding on that substantive critique, i.e. complexity. Port knocking strips you of the benefits you get from session protocols like TCP."
This is correct and worth considering.
In actual practice (again, over 15 years, all over the world, etc.) I have found that the only place I ever run into this is on airplane (in-air) wifi. I don't know if they are specifically blocking random fragments or if they are just too laggy to make this scheme work.
A quick workaround is to ssh to some other host that you control that isn't behind a knock, but does have 'knock' installed and then jump through it.
You could of course just try again if it fails due to these excessively rare cases.
There are a lot of things that fail if packets arrive out of order and with random packet loss your experience is going to be awful, so both of these are rare.
- Fails when packet loss is high.
- Fails when lags make the attempts arrive in changed order
- Fails when multiple people try to execute the sequence at the same time (yes, you can track source IPs, but then it doesn't work from behind a NAT)
Agreed, none of this is a problem on a small scale. Agreed, you can work around that but it's a PITA.