[rsync]

Heh.

In short, port knocking is a very, very short/weak password. And is a very weak authentication measure.

This is absolutely true and nobody could argue that.

So if you only did port knocking, or if you depended on port knocking, you're making a bad decision.

I believe in defense in depth, and therefore I think that port knocking on top of everything else you already do has good value - especially considering how simple and lightweight knockd is and my experience of it running stably for years at a time.