Skip to main content
protocols.pageprotocols.page
9418

Port 9418 – Git Protocol

TCP

Port 9418 is the Git native protocol (git://) port for read-only anonymous repository access. The git:// protocol has no encryption and no authentication – it is faster than HTTPS for public repository cloning but provides no security. Use HTTPS or SSH for any repository requiring access control or privacy.

Port Number

9418

Protocol

TCP

Service

Git Native Protocol (git://)

Range

IANA Registered (1024–49151)

Description

Git daemon on port 9418 serves repositories via the native Git protocol. The protocol is binary and optimized for fast pack negotiation – cloning large repositories over git:// is measurably faster than HTTPS because there is no TLS overhead or HTTP framing. However, git:// provides no encryption (repository contents are visible on the network) and no authentication (only anonymous read access). The git:// protocol was common when GitHub was young and bandwidth mattered. Modern networks and TLS implementations make the speed difference negligible. GitHub, GitLab, and Bitbucket have deprecated git:// access. The only remaining use case is serving public mirror repositories on fast networks where the performance difference matters (Linux kernel mirrors). Use SSH (port 22) for authenticated access and HTTPS (port 443) for public + authenticated access.

Security risks

  • 1Source code exposure: git:// serves repository contents to any client without authentication. If git-daemon is misconfigured (--export-all), internal repositories with proprietary code, credentials in history, or security-sensitive logic become publicly readable.
  • 2No encryption: all pack data, object references, and repository metadata travel in plaintext. A network observer between the client and git daemon sees every file, every commit message, and every branch name.
  • 3Anonymous push (catastrophic if enabled): git daemon with --enable=receive-pack allows anyone to push to the repository – injecting malicious code, rewriting history, or deleting branches without any authentication or audit trail.
  • 4Lack of audit logging: git:// protocol provides no access logs by default. Unlike HTTPS (web server access logs) or SSH (auth logs), git-daemon connections leave minimal trace, making breach detection impossible.

Firewall guidance

Do not expose port 9418 unless serving intentionally public repositories (Linux kernel mirrors, open-source projects). For private repositories, use SSH (port 22) or HTTPS (port 443) exclusively. If git-daemon runs for performance on internal mirrors, restrict port 9418 to internal CI/CD server IPs that need fast cloning. Never enable receive-pack on git-daemon.

Diagnosis commands

Test if git:// protocol is responding and list remote refs

shell
git ls-remote git://host/repo.git

Detect git-daemon remotely (should be closed on non-mirror servers)

shell
nmap -sV -p 9418 target

Check if git-daemon is running locally

shell
ss -tnlp sport = :9418

Verify git-daemon flags (check for --export-all or --enable=receive-pack)

shell
ps aux | grep git-daemon | grep -v grep

Usage examples

Port 9418 – Git Protocol
shell
git clone git://github.com/torvalds/linux.git (deprecated on GitHub)
git daemon --reuseaddr --base-path=/srv/git /srv/git
git daemon --export-all --enable=receive-pack (DANGEROUS – enables anonymous push)

Common services on this port

git-daemonLinux kernel mirror (git.kernel.org)Legacy self-hosted Git servers

Related ports

22

SSH/Git over SSH (authenticated, encrypted)

443

HTTPS/Git over HTTPS (authenticated, encrypted)

80

Git Smart HTTP (alternative)

History

The git:// protocol was created alongside Git itself by Linus Torvalds in 2005 for fast Linux kernel distribution. Port 9418 was registered with IANA for the Git protocol. In Git's early years, git:// was the fastest way to clone large repositories (no TLS handshake, no HTTP overhead). GitHub supported git:// until 2022, when it was removed due to security concerns. Modern Git Smart HTTP protocol (2010) with TLS 1.3 performs comparably to git:// while providing authentication and encryption.

FAQ

Is there any reason to still use git:// in 2024+?

Almost never. The performance advantage over HTTPS is negligible with modern TLS (1.3) and HTTP/2 multiplexing. The only remaining use case is high-volume public mirror servers (kernel.org) where authentication overhead matters at scale and the content is intentionally public. For anything else: SSH for developers, HTTPS for CI/CD and anonymous read access.

How do I disable git:// on my server?

Stop git-daemon: systemctl disable --now git-daemon. Remove inetd/xinetd entries for port 9418. Firewall: iptables -A INPUT -p tcp --dport 9418 -j DROP. Verify: nmap -p 9418 localhost shows closed. Migrate clients to HTTPS (git remote set-url origin https://...) or SSH (git remote set-url origin git@host:repo.git).