Skip to content
ProtocolPorts

Port reference

Port 79 (TCP) – Finger

Legacy protocol that returns information about users and their login status on a host.

tcpWell-known

Quick facts

Transport
tcp
Category
Well-known
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Disabled on modern systems but still found on legacy Unix and some appliances.

What is port 79 used for?

Port 79 is the default for Finger (RFC 1288), a 1970s-era service that returns information about users on a host — real name, home directory, login time, and whether someone is currently logged in. It was served by the classic Unix fingerd daemon (and clients like the finger command) so people could look up colleagues on shared systems. Today it is largely obsolete and disabled on modern systems, though a few legacy hosts and hobbyist servers still run it.

When would you open it?

There is rarely a practical reason to open port 79 today. The main cases are running a legacy Unix host, a nostalgia or hobby "finger" server sharing a public profile or status, or testing in a lab. Only open it if you deliberately run a finger daemon and accept that it shares user info openly.

Is it safe to open?

Finger leaks usernames and login activity in cleartext with no authentication, so it is best left disabled; if you must run it, keep it private and limit what it reveals. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :79
nmap -p 79 <target>
Windows
netstat -ano | findstr :79
Test-NetConnection <host> -Port 79
macOS
lsof -i :79
nmap -p 79 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 79 to your device's local IP, internal port 79, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 79/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=79/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 79 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 79" -Direction Inbound -Protocol TCP -LocalPort 79 -Action Allow

Security & risks

Common attacks

  • Username enumeration for follow-on brute force
  • Information leakage of login times, home directories, and idle status
  • Reconnaissance of valid accounts before targeted attacks

Hardening

  • Disable the finger daemon (fingerd) entirely
  • Block inbound TCP port 79 at the perimeter firewall
  • Remove legacy account-disclosure services from hosts
  • If a directory is needed, use an authenticated modern alternative

How to block this port

Linux (ufw)
sudo ufw deny 79/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=79/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 79 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 79" -Direction Inbound -Protocol TCP -LocalPort 79 -Action Block

nmap snippet

nmap -p79 --script finger <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 23Port 113Port 25Port 22

Frequently asked questions

What does the Finger protocol expose?
Finger returns details about users on a host — usernames, real names, home directories, login times, and idle status — all in cleartext and without authentication.
Why is port 79 a security risk?
It hands attackers a list of valid usernames and login patterns, which feeds password guessing and social engineering. It has no place on internet-facing systems.

Related guides