Skip to content
ProtocolPorts

Port reference

Port 4505 (TCP) – SaltStack Salt master (ZeroMQ)

ZeroMQ publish port of the Salt master where minions subscribe to receive commands.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
Critical

Actively exploited and high-impact — keep it off the public internet.

Default state

Open and bound to all interfaces on Salt masters by default, alongside the return port 4506. Authentication is at the Salt protocol layer, which has had critical auth-bypass bugs.

What is port 4505 used for?

Port 4505 is the SaltStack (Salt) publish bus. The Salt master — a configuration management and remote-execution tool — uses it to push commands and state to its managed servers, called minions, which subscribe here to receive them. It works as a pair with the return port 4506, where minions send back results. Together they form the control channel of a Salt-managed fleet.

When would you open it?

Open ports 4505 and 4506 between a Salt master and its minions on a private management network, so the master can reach all managed servers. They should only be reachable by your minions, never exposed to the public internet.

Is it safe to open?

A Salt master can run commands as root on every minion, and past auth-bypass bugs turned an exposed master into full fleet takeover. Keep it on a private network, firewall both ports, and patch Salt promptly. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :4505
nmap -p 4505 <target>
Windows
netstat -ano | findstr :4505
Test-NetConnection <host> -Port 4505
macOS
lsof -i :4505
nmap -p 4505 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 4505 to your device's local IP, internal port 4505, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 4505/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=4505/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 4505 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 4505" -Direction Inbound -Protocol TCP -LocalPort 4505 -Action Allow

Security & risks

Common attacks

  • Unauthenticated authentication bypass against the Salt master (CVE-2020-11651)
  • Directory traversal reading or writing master files (CVE-2020-11652)
  • Master-key theft leading to arbitrary command execution on all minions
  • Mass exploitation deploying cryptominers across managed fleets

CVE-2020-11651CVE-2020-11652

Hardening

  • Never expose 4505/4506 to the internet; restrict to managed minion networks
  • Patch Salt promptly — CVE-2020-11651/11652 enable full master RCE
  • Bind the master to a private interface and firewall the publish/return ports
  • Enable and verify minion key acceptance; rotate keys after any exposure
  • Monitor master logs and run Salt as a least-privileged, segmented service

How to block this port

Linux (ufw)
sudo ufw deny 4505/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=4505/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 4505 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 4505" -Direction Inbound -Protocol TCP -LocalPort 4505 -Action Block

nmap snippet

nmap -p4505,4506 --script http-title <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 4506Port 2375Port 6443Port 22

Frequently asked questions

What is the difference between port 4505 and 4506?
4505 is the Salt publish bus where minions subscribe for commands from the master. 4506 is the return/request port minions use to send results and request files. Both must be protected together.
How serious were the 2020 SaltStack vulnerabilities?
Critical. CVE-2020-11651 is an authentication bypass and CVE-2020-11652 a directory traversal. Chained, they let an unauthenticated attacker reach the Salt master, steal its key, and run arbitrary commands as root across every minion.

Related guides