Port reference
Port 513 (TCP) – rlogin
Legacy Berkeley remote-login service using cleartext and trust-based authentication via .rhosts.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Deprecated and disabled on modern systems, but still present on legacy Unix hosts and in lab images like Metasploitable.
What is port 513 used for?
Port 513 is used by rlogin, an old Berkeley remote-login service that gives you an interactive terminal session on a remote Unix machine. It works much like Telnet, and was once bundled into most Unix systems through the r-services tools (rlogin, rsh, rexec). Today it is largely replaced by SSH, but you may still find it on legacy Unix hosts and training images such as Metasploitable.
When would you open it?
You would only open or forward port 513 if you actually run an rlogin daemon (rlogind) and need legacy clients to reach it across a network. In nearly all cases there is no reason to enable it on modern systems, since SSH covers the same remote-login need.
Is it safe to open?
rlogin sends everything, including credentials, in plain text and trusts .rhosts entries, so keep it off public networks and reach it only over a VPN or trusted LAN, or switch to SSH. See the security notes below.
How to check if this port is open
ss -tulpn | grep :513
nmap -p 513 <target>netstat -ano | findstr :513
Test-NetConnection <host> -Port 513lsof -i :513
nmap -p 513 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 513 to your device's local IP, internal port 513, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 513/tcpsudo firewall-cmd --permanent --add-port=513/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 513 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 513" -Direction Inbound -Protocol TCP -LocalPort 513 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Cleartext credential and session capture via sniffing
- Trust-based authentication abuse via .rhosts and hosts.equiv
- Passwordless login from a spoofed trusted host
- Credential brute force against the rlogin daemon
Hardening
- Disable rlogin entirely and use SSH (port 22) instead
- Remove rlogind from inetd/xinetd and uninstall the r-services package
- Block inbound 513 at the perimeter firewall
- Audit and remove any .rhosts and hosts.equiv trust files
How to block this port
sudo ufw deny 513/tcpsudo firewall-cmd --permanent --remove-port=513/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 513 -j DROPNew-NetFirewallRule -DisplayName "Block 513" -Direction Inbound -Protocol TCP -LocalPort 513 -Action Blocknmap snippet
nmap -p513 --script rlogin-brute,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is rlogin on port 513 safe?
- No. rlogin is a legacy Berkeley r-service that sends the session and credentials in cleartext and trusts .rhosts files for passwordless login. It is trivially sniffed and spoofed — use SSH instead.
- What is the difference between rlogin and Telnet?
- Both give cleartext remote terminals, but rlogin adds Berkeley trust-based authentication via .rhosts that can allow passwordless login. Both are deprecated in favor of SSH on port 22.