Skip to main content
protocols.pageprotocols.page
543

Port 543 – Kerberos Login (klogin)

TCP

Port 543 is the Kerberos-authenticated remote login (klogin) port – a Kerberos-secured version of rlogin. Klogin provides single sign-on remote shell access using Kerberos tickets instead of passwords. Port 543 is largely obsolete – SSH with GSSAPI Kerberos authentication replaced it for encrypted remote access.

Port Number

543

Protocol

TCP

Service

Kerberos Login

Range

IANA Well-Known (0–1023)

Description

Kerberos login on port 543 was designed as a secure replacement for rlogin (port 513) by adding Kerberos ticket-based authentication. Instead of transmitting passwords, klogin uses the user's existing Kerberos TGT to authenticate the session. Port 543 is rarely used in modern environments. SSH with GSSAPI-keyex or GSSAPI-with-mic authentication provides the same Kerberos SSO experience over an encrypted channel. The only environments still running klogin on port 543 are legacy MIT Kerberos installations that predate SSH adoption.

Security risks

  • 1Protocol is entirely obsolete and unmaintained – any implementation still running port 543 has received no security patches in decades
  • 2No encryption of session data: klogin establishes authenticated sessions via Kerberos but does not encrypt the subsequent data stream (unlike SSH)
  • 3Replaced by SSH with GSSAPI: modern Kerberos-authenticated remote login uses SSH (port 22) with GSSAPIAuthentication yes, which provides both Kerberos auth AND encryption
  • 4Legacy rlogin trust model: systems running klogin may also have .rhosts and hosts.equiv files, enabling trust-based access without any credentials

Firewall guidance

Block port 543 unconditionally. There is no modern legitimate use. Any system still offering klogin should be migrated to SSH with Kerberos authentication (GSSAPIAuthentication yes in sshd_config). Check for old inetd/xinetd entries that might still start klogind.

Diagnosis commands

Check if anything is listening on port 543 (should be nothing)

shell
ss -tlnp | grep 543

Look for legacy inetd entries that might start klogind

shell
grep -r 'klogin\|eklogin' /etc/inetd.conf /etc/xinetd.d/ 2>/dev/null

Test SSH with Kerberos (the modern replacement for klogin)

shell
ssh -o GSSAPIAuthentication=yes host

Usage examples

Port 543 – Kerberos Login (klogin)
shell
klogin -l user remotehost
ssh -o GSSAPIAuthentication=yes host

Common services on this port

None active – entirely replaced by SSH with GSSAPI

Related ports

22

SSH (secure replacement)

88

Kerberos KDC

544

kshell (Kerberos remote shell, also obsolete)

513

rlogin (non-Kerberos, even more dangerous)

History

Klogin (Kerberos rlogin) was created in the 1980s at MIT as part of Project Athena. Port 543 provided Kerberos-authenticated remote login (unlike rlogin on port 513 which used .rhosts trust). It was widely used in academic and government networks before SSH was created in 1995. By 2000, SSH with GSSAPI/Kerberos support made klogin completely redundant. No modern OS ships with klogind enabled.

FAQ

How do I use Kerberos authentication with SSH instead?

Server: sshd_config: GSSAPIAuthentication yes, GSSAPICleanupCredentials yes. Client: ssh_config: GSSAPIAuthentication yes, GSSAPIDelegateCredentials yes. Ensure: the host has a host/hostname@REALM principal in its keytab, the user has a valid TGT (kinit). This gives single-sign-on via Kerberos with full SSH encryption – everything klogin was supposed to be but with modern security.

Specification

RFC 1411 – Port 543 specification →