540

Port 540/tcp is registered with IANA as uucp with the description "uucpd" (the same service name and description are registered on 540/udp) and blank assignee, contact, and reference fields. It carries UUCP (Unix-to-Unix Copy) over TCP for store-and-forward file transfer, remote command execution, and mail and news exchange between Unix systems. The uucpd / in.uucpd daemon lets the UUCP transfer program uucico run over a TCP connection instead of a modem or serial line: inetd invokes in.uucpd on a connect to port 540 (the default UUCP service port), which prompts for a login name and password to authenticate uucico and then carries UUCP's 'g' protocol with handshaking, error detection, and flow control. In configuration terms, a tcp-conn entry in the UUCP Systems/sys file makes uucico connect to TCP 540 on the remote host. UUCP dates to Bell Labs in the 1970s and 1980s and underpinned early Usenet and email before being eclipsed by FTP and SMTP; related assignments include 117 (the UUCP path service) and 541 (uucp-rlogin). The IANA reference field is blank. Security-wise it is an ancient store-and-forward design: the login and password are prompted by uucpd (often via PAM), the mechanism is historically weak, and the modern footprint is minimal, so an open 540 essentially indicates a legacy Unix host still offering UUCP-over-TCP. For an analyst, an open 540 is almost always obsolete and should be disabled unless a deliberate store-and-forward link is in use.

IANA assignment

uucp — "uucpd" (540/tcp and 540/udp); reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 540/tcp + 540/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000138 (de-facto) [Well-established] — nmap-services file

Related ports

117 (UUCP path service), 541 (uucp-rlogin)

Primary use

UUCP store-and-forward transfer/command/mail-news exchange over TCP (uucpd)

Other/unofficial uses

none today [Well-established]

Security implications

ancient store-and-forward; login/password prompted by uucpd, historically weak; minimal modern footprint [Well-established]

Typically seen on

legacy Unix hosts (Solaris BNU/HoneyDanBer UUCP, IBM z/OS uucpd, older BSD/Linux)

Analyst note

An open 540 is a legacy UUCP host; almost always obsolete — disable unless a deliberate store-and-forward link is in use.