Port reference
Port 79 (TCP) – Finger
Legacy protocol that returns information about users and their login status on a host.
Default state
Disabled on modern systems but still found on legacy Unix and some appliances.
Common attacks
- Username enumeration for follow-on brute force
- Information leakage of login times, home directories, and idle status
- Reconnaissance of valid accounts before targeted attacks
Hardening
- Disable the finger daemon (fingerd) entirely
- Block inbound TCP port 79 at the perimeter firewall
- Remove legacy account-disclosure services from hosts
- If a directory is needed, use an authenticated modern alternative
nmap snippet
nmap -p79 --script finger <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 79?
Port 79 is the default for Finger (RFC 1288), a 1970s-era service that returns
information about users on a host. A simple query can reveal a user's real
name, home directory, login time, idle time, and whether they are currently
logged in. It was meant as a convenience for finding colleagues on shared Unix
systems. Today it is disabled by default, but legacy hosts and some appliances
still run a fingerd.
Why it matters for security
Finger provides unauthenticated information disclosure. The data it hands out — especially valid usernames and login activity — is exactly what an attacker needs for the reconnaissance phase. Knowing which accounts exist and when they are active sharpens password guessing, social engineering, and targeted phishing. It is a textbook example of a legacy service that leaks more than it helps.
How it's attacked
Attackers query finger to enumerate valid accounts and harvest login patterns, then feed that list into brute-force and password-spraying attacks against SSH, mail, or VPN services. Empty or wildcard queries on some implementations dump the full user list at once. The reconnaissance value is high and the effort is trivial, which is why scanners still probe port 79.
Hardening checklist
Disable fingerd and remove the service from inetd/xinetd. Block inbound
TCP port 79 at the perimeter so external scanners cannot enumerate your users. If
you genuinely need a user directory, use an authenticated modern alternative
rather than an open cleartext service. The nmap snippet above shows what a finger
query reveals on hosts you are authorized to test.
Related ports
Frequently asked questions
- What does the Finger protocol expose?
- Finger returns details about users on a host — usernames, real names, home directories, login times, and idle status — all in cleartext and without authentication.
- Why is port 79 a security risk?
- It hands attackers a list of valid usernames and login patterns, which feeds password guessing and social engineering. It has no place on internet-facing systems.