Port reference
Port 512 (TCP) – rexec
Legacy Berkeley remote-execution service that passes credentials in cleartext over the network.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Deprecated and disabled on modern systems, but still present on legacy Unix hosts and in lab images like Metasploitable.
What is port 512 used for?
Port 512 is the well-known port for rexec, one of the legacy Berkeley r-services for running commands on a remote Unix host. A client sends a username, password, and command, and the rexecd daemon runs it and returns the output. It comes from an era of trusted networks and has been deprecated for decades, so today you mostly encounter it on old Unix systems or in practice images like Metasploitable.
When would you open it?
In practice there's almost no reason to open port 512 on a modern system. The only realistic case is keeping an old application running on an isolated legacy network that still depends on rexec. For any new setup, use SSH on port 22 instead.
Is it safe to open?
No, rexec sends usernames, passwords, and commands in cleartext and is trivially intercepted; replace it with SSH and block the port. See the security notes below.
How to check if this port is open
ss -tulpn | grep :512
nmap -p 512 <target>netstat -ano | findstr :512
Test-NetConnection <host> -Port 512lsof -i :512
nmap -p 512 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 512 to your device's local IP, internal port 512, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 512/tcpsudo firewall-cmd --permanent --add-port=512/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 512 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 512" -Direction Inbound -Protocol TCP -LocalPort 512 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Cleartext credential capture via sniffing
- Trust-based authentication abuse via .rhosts files
- Credential brute force against the rexec daemon
- Remote command execution on misconfigured hosts
Hardening
- Disable rexec entirely and use SSH (port 22) instead
- Remove rexecd from inetd/xinetd and uninstall the r-services package
- Block inbound 512 at the perimeter firewall
- Audit and remove any .rhosts and hosts.equiv trust files
How to block this port
sudo ufw deny 512/tcpsudo firewall-cmd --permanent --remove-port=512/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 512 -j DROPNew-NetFirewallRule -DisplayName "Block 512" -Direction Inbound -Protocol TCP -LocalPort 512 -Action Blocknmap snippet
nmap -p512 --script rexec-brute,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is rexec on port 512 safe to use?
- No. rexec is a legacy Berkeley r-service that transmits usernames, passwords, and commands in cleartext with no encryption. It is trivially sniffed and should be replaced by SSH.
- What replaces rexec?
- SSH on port 22 provides encrypted, authenticated remote command execution. Disable rexec, remove its daemon, and use SSH for all remote execution instead.