512

Port 512/tcp is registered with IANA as exec with the verbose description "remote process execution; authentication performed using passwords and UNIX login names" and blank assignee, contact, and reference fields. It is the Berkeley rexec service (rexecd / in.rexecd), one of the classic Unix r-commands: the client, via the rexec() library call, supplies a username and password in cleartext plus a command string, the daemon authenticates against the normal Unix login/password database and runs the command, and a secondary port is opened for stderr. The r-command suite premiered in BSD (broadly deployed from 4.2BSD, 1983). A critical disambiguation is that the UDP sibling on this number is a different service entirely: 512/udp is comsat/biff ("used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine"), which is local new-mail notification unrelated to remote execution — this entry is 512/tcp exec. The IANA reference field is blank. Security-wise, cleartext username and password traverse the network and are trivially sniffable, the service is brute-forceable (Metasploit and nmap have rexec brute-force tooling), and it is part of the universally deprecated r-services family; the 1988 Morris worm exploited rexec by guessing that a remote account reused the local password. For an analyst, an open 512/tcp signals an unhardened legacy Unix host exposing cleartext remote execution — a serious finding — and rexecd should be disabled in favor of SSH.

IANA assignment

exec — "remote process execution; authentication performed using passwords and UNIX login names"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 512/tcp + 512/udp, but 512/udp is a DIFFERENT service (comsat/biff)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000841 (de-facto) [Well-established] — nmap-services file

Related ports

513 (login/rlogin), 514 (shell/rsh) — the r-services trio; 543/544 (klogin/kshell, Kerberized); 22 (SSH, the replacement); 512/udp (comsat/biff — different)

Primary use

BSD remote command execution with cleartext credentials (rexecd)

Other/unofficial uses

none meaningful; superseded by SSH [Well-established]

Security implications

cleartext username+password (sniffable), brute-forceable; deprecated r-services family; Morris worm (1988) abused rexec password reuse [Well-established/Threat-reported]

Typically seen on

legacy Unix (Solaris, AIX, HP-UX, old Linux) running in.rexecd

Analyst note

An open 512/tcp signals an unhardened legacy Unix host exposing cleartext remote execution — a serious finding; disable rexecd and replace with SSH.