Skip to main content
protocols.pageprotocols.page
873

Port 873 – rsync

TCP

Port 873 is the rsync daemon port for efficient file synchronization using delta encoding. The rsync daemon mode (rsyncd) listens on port 873 and serves named modules with per-module access control. Rsync over SSH is preferred for security – daemon mode on port 873 has no encryption unless wrapped in stunnel or VPN.

Port Number

873

Protocol

TCP

Service

rsync file synchronization

Range

IANA Well-Known (0–1023)

Description

The rsync daemon on port 873 provides file synchronization without requiring SSH. Clients connect directly and request named modules defined in rsyncd.conf. Each module maps to a filesystem path with configurable read-only/read-write access, allowed hosts, and optional username/password authentication. Rsync daemon mode on port 873 transmits data unencrypted. The built-in authentication uses challenge-response but the file contents travel in plaintext. For internet-facing rsync, use rsync over SSH (rsync -e ssh) which encrypts everything. Port 873 is appropriate only on trusted internal networks or for serving public mirror repositories.

Security risks

  • 1CVE-2022-29154: rsync arbitrary file write – client-side path validation flaw allows malicious rsync server to write files outside the intended destination directory
  • 2No encryption (daemon mode): rsync on port 873 transmits all file data, names, and metadata in cleartext – complete filesystem contents visible to network observers
  • 3Anonymous read access: rsyncd modules configured without auth (e.g., [module] read only = yes, no auth users) allow any host to enumerate and download all shared files
  • 4Write access misconfiguration: rsyncd modules with 'read only = no' and no authentication allow attackers to upload files (webshells, cron jobs, SSH keys) to the server
  • 5Information disclosure via module listing: connecting to port 873 without specifying a module lists all available modules and their descriptions – revealing backup paths, internal project names, and directory structures

Firewall guidance

Strongly prefer rsync over SSH (rsync -e ssh) which uses port 22 and provides encryption + authentication natively. If rsyncd on 873 is needed (public mirrors, high-throughput backups): configure auth users, secrets file, hosts allow/deny in rsyncd.conf. Never allow write access without authentication. Block port 873 from the internet unless running a public mirror.

Diagnosis commands

List available rsync modules (should not work if properly secured)

shell
rsync rsync://target:873/

Attempt to list files in a module without auth (test for anonymous access)

shell
rsync rsync://target:873/module/ --list-only

Review rsync daemon configuration (check for modules without auth)

shell
cat /etc/rsyncd.conf

Check if rsyncd is running

shell
ss -tlnp | grep 873

Usage examples

Port 873 – rsync
shell
rsync rsync://mirror.example.com/
rsync -avz rsync://host/module /local/path
rsync --daemon --config=/etc/rsyncd.conf

Common services on this port

rsyncdrsync over SSH (does NOT use port 873)CPAN mirrorsLinux distribution mirrorsBackup scripts

Related ports

873

rsync daemon (this port)

22

SSH (rsync over SSH, preferred)

History

rsync was created by Andrew Tridgell and Paul Mackerras in 1996. The rsync algorithm (rolling checksum + delta encoding) revolutionized file synchronization by transferring only differences. Port 873 was assigned for the rsync daemon protocol. The daemon mode allows anonymous access (useful for mirrors) but lacks encryption. rsync over SSH (rsync -e ssh, no daemon needed) became the standard for authenticated, encrypted transfers. rsync 3.2.4 (2022) added built-in TLS support (--ssl flag).

FAQ

rsync over SSH vs rsync daemon – when to use which?

rsync over SSH (-e ssh): encrypted, authenticated, no daemon needed, slower for large transfers (SSH overhead). Use for: backups, deployments, any sensitive data. rsync daemon (port 873): no encryption, supports anonymous modules, faster throughput. Use for: public mirrors (CPAN, Linux repos), high-throughput LAN backups where encryption overhead matters. Never use daemon mode over untrusted networks without VPN.

How do I add authentication to rsyncd?

In rsyncd.conf: [mymodule] path = /data, auth users = backupuser, secrets file = /etc/rsyncd.secrets, hosts allow = 10.0.0.0/24. Create /etc/rsyncd.secrets: backupuser:StrongPassword (chmod 600). Client: rsync --password-file=/path/pass rsync://backupuser@server/mymodule/ /local/. Note: passwords are still sent in cleartext over the network – this protects against unauthorized access, not sniffing.