Port reference
Port 8140 (TCP) – Puppet Server
Default port for Puppet Server — agents connect over mutually authenticated TLS to fetch catalogs and configuration.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on the Puppet primary (master) server; uses TLS with a Puppet-managed certificate authority.
What is port 8140 used for?
Port 8140 is the default port for Puppet Server, the control plane of the Puppet configuration-management system. Puppet agents installed on managed servers connect to it over mutually authenticated TLS to request signed certificates and download catalogs that describe their desired state — packages, files, services, and commands to apply. It is the single port the Puppet agent talks to a Puppet primary on.
When would you open it?
Open 8140 on your Puppet primary so that managed nodes can reach it. Access should be limited to the networks where your agents live; there is no reason to expose it to the public internet.
Is it safe to open?
Puppet Server controls the configuration of every managed node, so a compromise can push changes fleet-wide; keep it on a trusted network and lock down certificate signing. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8140
nmap -p 8140 <target>netstat -ano | findstr :8140
Test-NetConnection <host> -Port 8140lsof -i :8140
nmap -p 8140 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8140 to your device's local IP, internal port 8140, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8140/tcpsudo firewall-cmd --permanent --add-port=8140/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8140 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8140" -Direction Inbound -Protocol TCP -LocalPort 8140 -Action AllowSecurity & risks
Common attacks
- Certificate-signing abuse to enrol rogue agents or obtain trusted certs
- Compromise of the Puppet CA leading to mass remote code execution on nodes
- Catalog/manifest tampering to push malicious configuration fleet-wide
- Exploiting Puppet Server / API vulnerabilities and weak autosign settings
Hardening
- Never expose 8140 to the internet; restrict to managed nodes and management networks
- Disable open/naive autosign and require manual or policy-based certificate signing
- Protect and back up the Puppet CA; rotate and revoke certificates promptly
- Enforce mutual TLS, least privilege on modules, and code review of manifests
- Keep Puppet Server patched and monitor certificate and catalog requests
How to block this port
sudo ufw deny 8140/tcpsudo firewall-cmd --permanent --remove-port=8140/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8140 -j DROPNew-NetFirewallRule -DisplayName "Block 8140" -Direction Inbound -Protocol TCP -LocalPort 8140 -Action Blocknmap snippet
nmap -p8140 --script ssl-cert,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 8140 used for?
- It is the default port for Puppet Server. Puppet agents connect to it over mutually authenticated TLS to request signed certificates and download catalogs that define a node's desired configuration.
- Why is port 8140 high-value to attackers?
- Puppet Server controls the configuration of every managed node. Compromising it — or its certificate authority — lets an attacker push malicious catalogs and achieve remote code execution across the entire fleet. Restrict 8140 to managed networks and disable naive autosign.