514
Summary
- // if you see it open
- Same trusted-host weaknesses as rlogin — no passwords, forgeable .rhosts/hosts.equiv trust, IP/DNS spoofing of trusted hosts, cleartext payload. The 1988 Morris worm used rsh trust (reading /etc/hosts.equiv, /.rhosts, .forward) to propagate without a password. Deprecated for SSH/scp.
- // common applications
- rsyslogsyslog-ngsyslogd
- // analyst note
- An open 514/tcp is the rsh trust service (do NOT mistake for syslog); a serious legacy-Unix finding — disable and move to SSH.
About port 514/tcp.
Port 514/tcp is registered with IANA as shell with the description "cmd like exec, but automatic authentication is performed as for login server" and blank assignee, contact, and reference fields. It is the Berkeley rsh service (rshd / in.rshd) serving the rsh and rcmd commands: unlike rexec, no password is sent, and authentication relies on a privileged source port plus .rhosts or hosts.equiv trust — the same trusted-host model as rlogin. Over the network, stdin and stdout flow on TCP 514 while stderr flows over a separate TCP port the daemon opens, and the rcp remote-copy command is built on rsh. There is no formal RFC; it is BSD-only. The single most important disambiguation for this port is that 514/udp is syslog (the BSD syslogd; registry reference [RFC5426], modified 2020-06-01), an entirely different protocol covered as a separate entry — and there is no standard TCP syslog on 514: syslog-over-TCP on 514 is a de-facto vendor convention only, while the IANA-registered reliable syslog is TCP 601 and TLS syslog is 6514. nmap-services even shows the comment "syslog" beside 514/tcp because the UDP sibling is so dominant, but the registered TCP service name is shell. The IANA reference field is blank. Security-wise, rsh carries the same trusted-host weaknesses as rlogin — no passwords, forgeable trust, IP/DNS spoofing of trusted hosts, cleartext payload — and the 1988 Morris worm used rsh trust relationships (reading /etc/hosts.equiv, /.rhosts, and .forward) to propagate to trusted neighbors without a password; it is deprecated for SSH and scp. For an analyst, an open 514/tcp is the rsh trust service and must not be mistaken for syslog — a serious legacy-Unix finding to disable in favor of SSH.
- IANA assignment
shell— "cmd like exec, but automatic authentication is performed as for login server"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 514/tcp + 514/udp, but 514/udp is a DIFFERENT service (syslog, [RFC5426])[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency ~0.011078 (de-facto; most-open of this batch on TCP) [Well-established] — nmap-services file
- Related ports
- 512 (exec/rexec), 513 (login/rlogin) — the r-services trio; 544 (kshell, Kerberized); 22 (SSH); 514/udp (syslog — different); reliable syslog 601, TLS syslog 6514
Primary use
BSD remote shell command execution with trusted-host authentication (rshd)
Other/unofficial uses
rcp remote copy is built on rsh; superseded by SSH/scp [Well-established]
Security implications
trusted-host weaknesses (no passwords, .rhosts/hosts.equiv, IP/DNS spoofing), cleartext; Morris worm (1988) propagated via rsh trust; deprecated for SSH [Well-established/Threat-reported]
Typically seen on
legacy Unix/Linux running in.rshd (Solaris, Metasploitable)
- Analyst note
- An open 514/tcp is the rsh trust service (do NOT mistake for syslog); a serious legacy-Unix finding — disable and move to SSH.
About port 514/udp.
Port 514/udp carries the classic BSD syslog event-logging protocol — a connectionless, fire-and-forget UDP datagram service with no delivery guarantee and no acknowledgement. Each message encodes a facility (the type of system or process) and a severity level in its PRI field, and the protocol became the universal logging mechanism for Unix systems, routers, switches, firewalls, and appliances after originating in Eric Allman's Sendmail in the 1980s. RFC 3164 (August 2001, Informational) documented the de-facto "BSD syslog" format as observed in the field; RFC 5424 (March 2009, Standards Track) defines the modern structured syslog protocol that obsoletes it, separating message format from transport, and RFC 5426 specifies the UDP transport mapping on well-known port 514 — which is the reference the IANA registry actually cites for this entry. For reliability and security, TCP and TLS transports are preferred: RFC 5425 defines TLS-protected syslog on port 6514, and RFC 6587 defines a TCP mapping. The security weaknesses of UDP/514 are intrinsic: it is cleartext (no encryption, no authentication), trivially spoofable, and lossy under congestion, so it is exposed both to data leakage (logs frequently contain sensitive detail) and to log-integrity attacks (an attacker can forge records or flood a collector to fill its disk as a denial of service). RFC 5426 itself recommends against use on unsecured networks and notes it provides neither strong sender authentication nor protection against message forgery. For an analyst, an open 514/udp indicates a syslog collector; verify it is not internet-exposed and consider migrating to TLS syslog on 6514. Note the transport split: 514/tcp is a different service entirely — shell (the BSD rsh/rshd remote shell).
- IANA assignment
syslog— description blank in the registry row; reference [RFC5426]; assignee/contact blank; modified 2020-06-01 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.119804 (common on infrastructure) [Well-established] — nmap-services file
- Related ports
- 514/tcp (
shell/rsh — different service); 6514 (syslog over TLS); 601 (reliable syslog, RFC 3195)
Primary use
BSD/structured system-logging message reception over UDP
Other/unofficial uses
ad-hoc event ingestion by SIEM/log pipelines [Well-established]
Security implications
cleartext, no authentication, trivially spoofable; no delivery guarantee (silent log loss); log injection/forgery and flood-DoS; RFC 5426 advises against unsecured-network use; prefer RFC 5425 TLS syslog on 6514
Typically seen on
syslog collectors / SIEM and essentially all network gear (routers, switches, firewalls, Linux servers, IoT)
- Analyst note
- Open 514/udp indicates a syslog collector. Verify it is not internet-exposed and consider migration to TLS syslog (6514). Do not conflate with 514/tcp shell.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| syslog | UDP | BSD syslogd(8) | 11.98% |
| shell | TCP | syslog | 1.11% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.