513

Port 513/tcp is registered with IANA as login with the verbose description "remote login a la telnet; automatic authentication performed based on priviledged port numbers and distributed data bases which identify \"authentication domains\"" — the registry literally contains the misspelling "priviledged" — with blank assignee, contact, and reference fields. It is the Berkeley rlogin service (rlogind), implementing RFC 1282 (BSD Rlogin, December 1991, which obsoletes RFC 1258), and it provides a remote-echoed, locally flow-controlled virtual terminal between Unix hosts over TCP contact port 513, with the client sending four null-terminated strings on connect. Its defining feature — and weakness — is that it can bypass passwords entirely when the connection originates from a trusted host, established via a privileged source port plus .rhosts or hosts.equiv trust files. A critical disambiguation is that the UDP sibling on this number is a different service: 513/udp is who (rwho/rwhod), which "maintains data bases showing who's logged in to machines on a local net and the load average of the machine" — this entry is 513/tcp login. The IANA reference field is blank (the protocol is documented in RFC 1282, but the registry row cites no reference). Security-wise this is the classic trust-based attack surface: RFC 1282's own cautionary note warns that trusted-host password bypass "has been successfully exploited in previous attacks on the internet" and that compromising one host opens all hosts configured to trust it, and specific risks include .rhosts/hosts.equiv "+ +" misconfiguration, DNS or network compromise letting an untrusted host masquerade as trusted, and TCP source-address spoofing (the technique Robert T. Morris described in 1985) — all over cleartext. For an analyst, an open 513/tcp marks a host honoring Berkeley trusted-host login; audit .rhosts and hosts.equiv, treat it as high-risk, and migrate to SSH.

IANA assignment

login — "remote login a la telnet; automatic authentication performed based on priviledged port numbers and distributed data bases which identify \"authentication domains\"" (registry misspells "priviledged"); reference (blank — RFC 1282 is the defining spec but is NOT cited in the registry row); assignee/contact blank; dual-registered 513/tcp + 513/udp, but 513/udp is a DIFFERENT service (who/rwho)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.005595 (de-facto) [Well-established] — nmap-services file

Related ports

512 (exec/rexec), 514 (shell/rsh) — the r-services trio; 543 (klogin, Kerberized); 22 (SSH); 513/udp (who/rwho — different)

Primary use

BSD remote interactive terminal login (rlogind, RFC 1282)

Other/unofficial uses

none meaningful; superseded by SSH [Well-established]

Security implications

trusted-host password bypass (.rhosts/hosts.equiv "+ +"); host-masquerade via DNS/network compromise; TCP source-address spoofing (Morris 1985); cleartext; RFC 1282 warns it has been exploited

Typically seen on

legacy Unix/Linux (Solaris, AIX, HP-UX, old Red Hat) running in.rlogind

Analyst note

An open 513/tcp marks a host honoring Berkeley trusted-host login; audit .rhosts/hosts.equiv, treat as high-risk, and migrate to SSH.