Skip to main content
protocols.pageprotocols.page
544

Port 544 – Kerberos Shell (kshell)

TCP

Port 544 is the Kerberos-authenticated remote shell (kshell/krcmd) port – a secure version of rsh that uses Kerberos tickets for authentication. Like port 543 (klogin), port 544 is obsolete. SSH with Kerberos GSSAPI provides the same functionality with full channel encryption.

Port Number

544

Protocol

TCP

Service

Kerberos Remote Shell

Range

IANA Well-Known (0–1023)

Description

Kerberos remote shell on port 544 enables command execution on remote hosts authenticated via Kerberos tickets. It was the secure evolution of rsh (port 514/TCP) – removing the need for .rhosts trust files by using cryptographic authentication. Port 544 provided authenticated but not encrypted command execution. The Kerberos ticket proves identity, but command output travels in cleartext. SSH replaced this entirely by combining Kerberos authentication (via GSSAPI) with full session encryption. Port 544 should be blocked on all modern networks.

Security risks

  • 1Entirely obsolete and unmaintained – no security patches available for any kshell implementation
  • 2No encryption of command output: kshell authenticates via Kerberos but the shell session itself is unencrypted (commands and output visible to network sniffers)
  • 3Legacy .k5login trust: systems with kshell may have .k5login files granting cross-realm access that was never audited or revoked
  • 4Same vulnerabilities as rsh: buffer overflows in argument handling, environment variable injection, and no session isolation

Firewall guidance

Block port 544 unconditionally. Migrate any remaining kshell usage to SSH with Kerberos (GSSAPIAuthentication). Check for residual xinetd/inetd entries on legacy Unix systems.

Diagnosis commands

Check if anything is listening on port 544 (should be nothing)

shell
ss -tlnp | grep 544

Find legacy service entries

shell
grep -r 'kshell\|ekshell' /etc/inetd.conf /etc/xinetd.d/ 2>/dev/null

Usage examples

Port 544 – Kerberos Shell (kshell)
shell
kshell remotehost command
ssh -o GSSAPIAuthentication=yes host 'command'

Common services on this port

None active – entirely replaced by SSH with GSSAPI

Related ports

22

SSH (secure replacement)

88

Kerberos KDC

543

klogin (Kerberos login, also obsolete)

514

rsh (non-Kerberos shell, also dangerous)

History

Kshell (Kerberos remote shell) was the authenticated version of rsh (port 514), created at MIT in the 1980s as part of Project Athena's Kerberos suite. Port 544 provided Kerberos-authenticated remote command execution. SSH (1995) made kshell entirely redundant by combining authentication, encryption, and remote shell into one protocol. No modern operating system includes kshell support.

FAQ

Is there any reason to keep port 544 open?

No. There is no modern use case for kshell. SSH with GSSAPIAuthentication provides the exact same functionality (Kerberos-authenticated remote shell) with the addition of AES encryption, key exchange, and modern security. If you find port 544 open on any system, it indicates an extremely outdated configuration that needs immediate remediation.