Port reference
Port 873 (TCP) – rsync daemon
rsync daemon — native rsync protocol for module-based file synchronization.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open only where rsyncd is run as a service (mirrors, backups). Frequently misconfigured with anonymous, world-readable modules.
What is port 873 used for?
Port 873 is the native protocol of the rsync daemon (rsyncd), used to synchronize files between machines through named "modules" that point to directories. You reach it with the ordinary rsync command using the rsync:// syntax, and it powers most public software mirrors, backup servers, and content distribution setups. Because rsync only transfers the parts of files that changed, it is efficient for large or frequent syncs.
When would you open it?
You open port 873 only if you run an rsync daemon that other machines need to pull from or push to, such as a mirror, a backup target, or an internal file-sync server. Most people instead run rsync over SSH on port 22, which needs no extra port opened. Leave 873 closed unless you specifically operate rsyncd.
Is it safe to open?
The native daemon sends data in cleartext and its anonymous modules are easily exposed, so require authentication, keep it on a private network or VPN, and prefer rsync over SSH for anything sensitive. See the security notes below.
How to check if this port is open
ss -tulpn | grep :873
nmap -p 873 <target>netstat -ano | findstr :873
Test-NetConnection <host> -Port 873lsof -i :873
nmap -p 873 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 873 to your device's local IP, internal port 873, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 873/tcpsudo firewall-cmd --permanent --add-port=873/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 873 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 873" -Direction Inbound -Protocol TCP -LocalPort 873 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Anonymous module enumeration and download (data exfiltration)
- Writable modules abused to upload or overwrite files
- Cleartext credential and data interception over the network
- Path traversal / module misconfiguration exposing the filesystem
Hardening
- Require auth (auth users + secrets file); disable anonymous access
- Set 'read only = yes' and tightly scope each module's path
- Bind to a management interface and firewall TCP 873 from the internet
- Prefer rsync over SSH (port 22) instead of the standalone daemon
- Use 'hosts allow'/'hosts deny' and keep rsync patched
How to block this port
sudo ufw deny 873/tcpsudo firewall-cmd --permanent --remove-port=873/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 873 -j DROPNew-NetFirewallRule -DisplayName "Block 873" -Direction Inbound -Protocol TCP -LocalPort 873 -Action Blocknmap snippet
nmap -p873 --script rsync-list-modules <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is the rsync daemon on port 873 encrypted?
- No. The native rsync daemon protocol on TCP 873 is cleartext with weak optional auth. For confidentiality and strong auth, run rsync over SSH (port 22) instead.
- Why are anonymous rsync modules dangerous?
- An anonymous, world-readable module lets anyone who reaches port 873 list and download its files — a common cause of accidental data exposure on public mirrors.