544
Summary
- // if you see it open
- Same posture as klogin — strong Kerberos auth, but data cleartext unless Kerberos v5 -x encryption is used. Historically a separate ekshell port (545) carried encrypted rsh; modern KCMDV0.2 shares the kshell port (544) and signals encryption with a -x command prefix. The kshd-to-client stderr back-connection to an arbitrary high port complicates firewalling. Deprecated for SSH.
- // analyst note
- An open 544/tcp indicates a legacy Kerberos host offering krsh; same triage as 543 — confirm encryption and migrate to SSH.
About port 544/tcp.
Port 544/tcp is registered with IANA as kshell with the description "krcmd" and blank assignee, contact, and reference fields (the UDP sibling kshell 544/udp is likewise "krcmd"). It is the Kerberos-authenticated remote shell and command-execution service — the Kerberos analog of Berkeley rsh (514) — served by kshd, and the classic /etc/services annotates 544 as Kerberized rsh (v5); the alias krcmd reflects the kcmd/krcmd client library. In operation, the client opens TCP to kshell, declares Kerberos 5, negotiates a protocol version (KCMDV0.1 or KCMDV0.2), and then runs the classic rsh exchange, with kshell requiring a second TCP connection for stderr (the client sends an ASCII port number for the daemon to call back). An encryption nuance parallels klogin: historically there was a separate ekshell port (545) for encrypted rsh, but in modern KCMDV0.2 the encrypted and plaintext modes share the kshell port (544) and the client signals encryption by prefixing the command with -x; as with klogin, Kerberos v4 Kerberized only the authentication, leaving session data in cleartext. The IANA reference field is blank. Security-wise the posture matches klogin — strong authentication, but data cleartext unless v5 -x encryption is used — and the kshd-to-client stderr back-connection to an arbitrary high port complicates firewalling; the service is deprecated for SSH. For an analyst, an open 544/tcp indicates a legacy Kerberos host offering krsh, with the same triage as 543: confirm encryption and migrate to SSH.
- IANA assignment
kshell— "krcmd"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 544/tcp + 544/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency ~0.005269 (de-facto) [Well-established] — nmap-services file
- Related ports
- 514 (rsh/shell), 543 (klogin), 545 (ekshell), 88 (kerberos)
Primary use
Kerberos-authenticated remote shell/command execution (kshd), the Kerberos analog of rsh
Other/unofficial uses
none meaningful; superseded by SSH [Well-established]
Security implications
Kerberos auth (no .rhosts) BUT data cleartext unless v5 -x encryption (historically ekshell was 545; modern KCMDV0.2 shares 544 via -x); stderr back-connection to a high port complicates firewalling; deprecated for SSH [Well-established]
Typically seen on
legacy MIT/Heimdal Kerberos realm hosts, older Unix
- Analyst note
- An open 544/tcp indicates a legacy Kerberos host offering krsh; same triage as 543 — confirm encryption and migrate to SSH.
About port 544/udp.
Port 544/udp is registered with IANA as kshell with the description string krcmd and a blank reference field; the assignee, contact, registration date, and modification date columns in the IANA registry are all empty. The same name and description are dual-registered on 544/tcp, and that TCP side is the assignment that actually corresponds to a deployed protocol. kshell is the Kerberos-authenticated replacement for the BSD rsh (remote shell) command: instead of relying on .rhosts/privileged-port trust, the client and the kshd daemon authenticate with Kerberos V5 tickets, eliminating plaintext password exchange. In practice kshell is a TCP-only service — MIT Kerberos documentation and the kshd(8) man page show it configured in inetd as kshell stream tcp, and no documented UDP implementation exists. The UDP registration is best read as a legacy mirror of the TCP assignment rather than a live service vector. Security-wise, kshell authenticates strongly but transmits command output in cleartext unless the encryption (-x) flag is used, and the kshd model (where the server opens a return connection to the client on a high port) complicates firewalls; SSH has displaced it almost everywhere. Because nothing binds 544/udp in real deployments, the UDP entry itself is essentially never a live attack surface — any genuine kshd exposure is on the TCP path of a legacy Unix host. For an analyst, a responsive 544 is far more likely to be the TCP kshd daemon left running on an old system than anything UDP-specific.
- IANA assignment
kshell— descriptionkrcmd; reference (blank — no RFC cited in IANA registry); assignee/contact/registration date/modification date all blank; dual-registered 544/tcp + 544/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 1109; TCP counterpart line 1108)- Range class
- well-known (0–1023) [Confirmed] — port number 544 is within 0–1023
- Related ports
- 543/tcp
klogin(Kerberos rlogin), 544/tcpkshellcounterpart, 514/tcpshell/rsh (the non-Kerberos original), 749/750 Kerberos admin/legacy
Primary use
Kerberos-authenticated remote shell (kshd), a Kerberos V5 replacement for BSD rsh; in practice TCP-only — the UDP assignment is a legacy mirror with no documented UDP implementation
Common software
MIT Kerberos krb5 suite (kshd daemon via inetd/xinetd); legacy Red Hat/Fedora krb5-workstation, historical Solaris/AIX Kerberos integrations; no modern software targets 544/udp specifically
Security implications
Kerberos-ticket auth (no plaintext passwords) but cleartext command output unless -x encryption is used; kshd return-connection model complicates firewalls; superseded by SSH; UDP/544 has no bound service so the live attack surface is the TCP kshd daemon on legacy Unix hosts
Typically seen on
legacy Unix hosts with MIT Kerberos rsh-equivalent services enabled (TCP); a UDP/544 response is anomalous
- Description meaning
krcmd= the Kerberos remote-shell/remote-command service; this expansion is not stated in the IANA CSV itself, only the literal stringkrcmdis registered [Likely] — kshd(8) man page- Scanning/exposure
- 544 (TCP+UDP) appears in standard scanner port lists; UDP scans of 544 typically return open|filtered/closed since nothing binds it; no CVEs specific to a 544/udp vector — historical kshd flaws affect the TCP path [Likely] — Nmap UDP scan docs, kshd(8)
- Analyst note
- Treat a live 544 as the TCP kshd daemon on a legacy system, not a UDP service. Investigate why a Kerberos rsh replacement is still running rather than SSH; confirm the registry reference field is genuinely blank (do not infer an RFC).
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| kshell | TCP | krcmd Kerberos (v4/v5) | 0.53% |
| kshell | UDP | krcmd Kerberos (v4/v5) | 0.05% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.