Skip to main content
protocols.pageprotocols.page
749

Port 749 – Kerberos Admin

TCP

Port 749 is the Kerberos administration (kadmind) port for managing principals, policies, and keytabs. The kadmin service on port 749 allows remote creation and deletion of Kerberos principals. Access should be restricted to Kerberos administrators only – unauthorized access enables full realm compromise.

Port Number

749

Protocol

TCP

Service

Kerberos Administration (kadmind)

Range

IANA Well-Known (0–1023)

Description

The Kerberos administration daemon (kadmind) on port 749 provides remote management of the Kerberos database. Administrators connect via kadmin to create principals, set password policies, extract keytabs, and manage access control lists for the realm. Port 749 is a high-value target – access to kadmind means the ability to create arbitrary principals, extract service keytabs, and effectively compromise the entire Kerberos realm. In Active Directory environments, this function is handled by LDAP-based tools rather than kadmind. MIT Kerberos and Heimdal deployments should restrict port 749 access to dedicated admin workstations via firewall rules.

Security risks

  • 1Full KDC compromise: port 749 provides kadmin access – creating principals, extracting keytabs, modifying policies. Unauthorized access = complete Kerberos realm takeover
  • 2Keytab extraction: kadmin allows extracting service keytabs (ktadd). A leaked keytab for any service principal allows impersonation of that service indefinitely
  • 3Password policy bypass: kadmin can override password policies (set password for any principal, disable pre-authentication, modify max life/renew life)
  • 4No encryption in transit (MIT Kerberos < 1.20): kadmin protocol did not mandate encryption for all operations in older versions – credentials could be sniffed
  • 5Weak kadmin authentication: if kadmin/admin principal has a guessable password, brute-force on port 749 gives full realm control

Firewall guidance

Port 749 should be accessible ONLY from Kerberos admin workstations (typically 1-2 machines). Block from all servers, clients, and certainly the internet. Active Directory does NOT use port 749 (it manages principals via LDAP/RPC). Only MIT Kerberos and FreeIPA deployments use kadmind on 749. If using FreeIPA: restrict to IPA server replicas and admin hosts.

Diagnosis commands

Test kadmin connectivity and list principals (should require auth)

shell
kadmin -p admin/admin@REALM -q 'listprincs' 2>&1 | head -5

Check if kadmind is running on the KDC

shell
ss -tlnp | grep 749

View password policy (must run locally on KDC)

shell
kadmin.local -q 'getpol default'

Verify kadmin port accessibility (should only be open from admin subnet)

shell
nmap -p 749 kdc.example.com

Usage examples

Port 749 – Kerberos Admin
shell
kadmin -p admin/admin@REALM
kadmin.local: addprinc user@REALM
kadmin: ktadd -k /etc/krb5.keytab host/server@REALM

Common services on this port

MIT Kerberos kadmindHeimdal kadmindActive Directory (uses LDAP for admin, not 749)FreeIPA

Related ports

88

Kerberos KDC (authentication)

464

kpasswd (user password changes)

749

kadmin (this port)

750

kerberos-iv (legacy, obsolete)

History

Port 749 was assigned for the Kerberos administration protocol (kadmin) as part of MIT Kerberos V5. The kadmin service allows remote management of the KDC database: creating/deleting principals, extracting keytabs, and modifying policies. Active Directory chose a different path – managing Kerberos principals through standard AD tools (LDAP, MMC) rather than kadmin. FreeIPA wraps kadmin in its own API but still runs kadmind on 749 for backward compatibility.

FAQ

Does Active Directory use port 749?

No. Active Directory manages Kerberos principals through LDAP (port 389/636) and RPC, not through kadmin. Port 749 is only used by MIT Kerberos and FreeIPA deployments. If you're running a pure AD environment, port 749 is not needed and should be blocked. FreeIPA environments need 749 open between IPA servers and admin workstations.

How do I secure kadmin access?

1. Restrict port 749 to specific admin IPs (firewall/ACL). 2. Use strong passwords for admin principals (admin/admin@REALM should have 20+ char random password). 3. Create per-admin principals (jsmith/admin@REALM) instead of sharing one. 4. Enable kadmind logging: log_file = /var/log/kadmind.log in kdc.conf. 5. Consider using kadmin.local (socket-based, no network) for most operations.

Specification

RFC 4120 – Port 749 specification →