749

Port 749/tcp is registered with IANA as kerberos-adm with the description "kerberos administration" and a likely-blank reference field (dual-registered on TCP and UDP); the IANA row was corroborated against MIT Kerberos documentation and authoritative port references but was not re-verified against the live IANA CSV this session, so the exact strings should be confirmed before promotion. It is the MIT Kerberos administration protocol — the kadmind admin server that handles principal and policy administration via the kadmin client and password changes. MIT documentation gives the default port for the admin server as 749, with the standard /etc/services lines "kerberos-adm 749/tcp # Kerberos 5 admin/changepw" and "kerberos-adm 749/udp," and the DNS SRV record _kerberos-adm._tcp pointing to port 749; in practice TCP is preferred for the admin protocol because it carries reliable, sensitive bulk operations such as adding users, setting password policy, and exporting keytabs. The IANA reference is likely blank. Security-wise an open 749 fingerprints a Kerberos KDC or admin server and therefore a realm, which is useful reconnaissance for an attacker (relate to the nmap NSE krb5-enum-users script), and because kadmind handles highly sensitive operations it must be tightly firewalled to administrative hosts; note that in certain package versions kadmind does not bind 749, as seen in a CentOS 6.5 krb5-server report. For an analyst, an open 749 indicates a Kerberos KDC/admin server and should be restricted to admin networks; it sits in the Kerberos cluster alongside 88, 464, 543/544, and the legacy v4 port 750.

IANA assignment

kerberos-adm — "kerberos administration"; reference (likely blank; IANA row not re-confirmed against the live CSV this session — verify before DONE); dual-registered 749/tcp + 749/udp (TCP preferred operationally) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low (Kerberos hosts); nmap-services de-facto low [Well-established] — nmap-services file

Related ports

88 (kerberos/KDC), 464 (kpasswd), 543/544 (klogin/kshell), 750 (legacy v4 KDC), 754 (krb5_prop), 2105 (eklogin)

Primary use

MIT Kerberos administration (kadmind / kadmin) and password changes

Other/unofficial uses

none meaningful [Well-established]

Security implications

fingerprints a KDC/admin server and realm; kadmind handles sensitive operations — firewall to admin hosts; nmap krb5-enum-users recon [Well-established/Threat-reported]

Typically seen on

MIT/Heimdal Kerberos KDC/admin servers

Analyst note

An open 749 indicates a Kerberos KDC/admin server; restrict to admin networks — it sits in the Kerberos cluster with 88/464/543/544/750.