543

Port 543/tcp is registered with IANA as klogin with a blank description field and blank assignee, contact, and reference fields (the UDP sibling klogin 543/udp is likewise blank). It is the Kerberos-authenticated remote login service — the Kerberos analog of Berkeley rlogin (513) — served by klogind, and the classic /etc/services annotates 543 as Kerberized rlogin (v5). Functionally it behaves like rlogin, but authentication is via Kerberos tickets, with a .k5login file in the remote user's home directory listing authorized principals, instead of the .rhosts or trusted-host IP trust that made the plain r-services so dangerous; it is part of the MIT/Heimdal Kerberos "appl" / Berkeley-r suite. A critical nuance is the difference between authentication and encryption: Kerberos v4-era versions Kerberized only the authentication, so session data still traveled in cleartext and was sniffable, while Kerberos v5 added optional encryption — and the encrypted variant of rlogin uses a separate service, eklogin, on port 2105, not 543. The IANA reference field is blank. Security-wise klogin is better than the plain r-services because it removes .rhosts host trust and uses mutual Kerberos authentication, but an unencrypted klogin session still leaks data on the wire, and the whole family is deprecated in favor of SSH. For an analyst, an open 543/tcp indicates a legacy MIT/Heimdal Kerberos realm host running klogind; confirm whether v5 encryption is enforced and migrate to SSH.

IANA assignment

klogin — (description blank in registry); reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 543/tcp + 543/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.005282 (de-facto) [Well-established] — nmap-services file

Related ports

513 (rlogin), 514 (shell/rsh), 544 (kshell), 88 (kerberos), 2105 (eklogin — encrypted), 749/750 (kerberos-adm/kadmin)

Primary use

Kerberos-authenticated remote login (klogind), the Kerberos analog of rlogin

Other/unofficial uses

none meaningful; superseded by SSH [Well-established]

Security implications

stronger than plain r-services (Kerberos auth, no .rhosts trust) BUT data is cleartext unless Kerberos v5 -x encryption is used (encrypted rlogin is eklogin/2105); deprecated for SSH [Well-established]

Typically seen on

legacy MIT/Heimdal Kerberos realm hosts, older Unix

Analyst note

An open 543/tcp indicates a legacy Kerberos realm / Unix host running klogind; confirm whether v5 encryption is enforced and migrate to SSH.

Port 543/udp is registered with IANA as klogin in the Service Name and Transport Protocol Port Number Registry, with the description, assignee, contact, and reference columns all left blank — that emptiness is sourced fact, not an omission. The port is dual-registered: both 543/tcp and 543/udp carry the same service name, a legacy artifact of the era when IANA automatically assigned both transports for every well-known port request (a practice ended by RFC 6335 in 2011, though existing assignments were never retroactively reclassified). klogin is the Kerberos-authenticated remote login service — the kerberized successor to BSD rlogin — historically used by MIT Kerberos to provide authenticated remote shells. In practice, however, klogin operates exclusively over TCP: the MIT Kerberos V5 administrator documentation lists only klogin 543/tcp in its firewall configuration tables and references no UDP implementation, and no software is documented as actually using 543/udp for klogin traffic. The UDP side is, for analytic purposes, a registry artifact with essentially no real-world listener exposure. For an analyst, klogin matters mainly as a legacy fingerprint: the encrypted variant eklogin uses 2105/tcp and the kerberized rsh companion kshell uses 544/tcp, and the whole rlogin family (512–514, 543–544) has been broadly superseded by SSH, which folds authentication and encryption into one protocol. A responsive 543/udp is therefore statistically rare and worth treating as an anomaly rather than a normal service.

IANA assignment

klogin — description, assignee, contact, and reference columns all blank in the registry; dual-registered 543/tcp + 543/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Range class

well-known (0–1023) [Confirmed]

IANA reference (RFC)

blank in the current registry row; the historic RFC 1340 "Assigned Numbers" lists klogin 543/tcp and klogin 543/udp with no per-protocol reference document [Confirmed] — RFC 1340 (https://datatracker.ietf.org/doc/html/rfc1340)

Related ports

544/tcp kshell (kerberized rsh), 2105/tcp eklogin (encrypted klogin), and the rlogin/rsh family 512–514 [Confirmed] — MIT krb5 docs

Prevalence / exposure

essentially no real-world 543/udp listener exposure; no CVE or threat-intel scan reports specific to 543/udp located; appears in some default port-scanner UDP lists by name, not observed traffic

[Likely] — pentest-tools default port list, Shodan ports data (https://support.pentest-tools.com/scanner-default-port-list)

Registration date

Unknown (registry column blank; not fabricating a date) [Unknown]

Primary use

Kerberos-authenticated remote login (kerberized rlogin); in practice runs over TCP, not UDP [Confirmed] — MIT Kerberos V5 firewall docs list only klogin 543/tcp (https://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-admin/Configuring-Your-Firewall-to-Work-With-Kerberos-V5.html)

Common software

MIT Kerberos V5 (krb5) implements klogin over TCP; GNU Shishi documents kerberized rlogin on 543/tcp; no UDP implementation documented

Dual-registration rationale

legacy auto-assignment of both transports, a practice ended by RFC 6335 (2011) without retroactive reclassification of existing assignments [Confirmed] — RFC 6335 (https://www.rfc-editor.org/rfc/rfc6335.html)

Legacy / deprecation status

legacy protocol broadly superseded by SSH; eklogin (2105) is the encrypted alternative even within Kerberos contexts [Confirmed] — MIT krb5 docs, RFC 6335

Analyst note

A responsive 543/udp is statistically rare — no documented UDP implementation exists, so treat it as an anomaly, decoy, or misconfiguration rather than a legitimate klogin service.