Port 514RSH / REMSH
Remote Shell (rsh or remsh) is a legacy protocol designed to execute shell commands on a remote Unix system in a non-interactive fashion. It operates primarily over TCP, allowing administrators or automated systems to issue single commands remotely. Despite its historical usage, RSH is largely deprecated due to its insecure design, transmitting data in plaintext, including user credentials, posing significant security risks in modern network environments..
- transport
- tcp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 9,159
single transport
payload readable on path
registered with iana
caution
rank 530 of 993 · top 53%
1 other service is registered on port 514. compare all 2 →
Technical Details
what runs on :514Remote Shell (RSH) is part of the Berkeley r-commands suite, enabling users to execute single, non-interactive commands remotely. Unlike interactive sessions offered by protocols like Telnet or SSH, RSH executes the specified command and then disconnects. It is primarily used for scripting, remote system administration, and automation, particularly in trusted local network environments.
RSH communicates over TCP port 514. Authentication is traditionally based on trust relationships defined in .rhosts or /etc/hosts.equiv files, which determine user mapping and access permissions without requiring passwords, relying heavily on trust between systems. As such, it was commonly used within secured, internal networks with known hosts.
Due to the lack of encryption and strong authentication mechanisms, RSH protocols have fallen out of favor. Today's best practices replace RSH with Secure Shell (SSH), which provides robust encryption and authentication, addressing the security deficiencies inherent in RSH.
Security Information
exposure of :514risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 0.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp
every listening transport is another surface to filter at the edge
security overview
Common Vulnerabilities:
- Transmits credentials and data in plaintext, susceptible to eavesdropping and interception by attackers.
- Trust-based authentication easily exploited if
rhostsorhosts.equivfiles are misconfigured or compromised. - Susceptible to IP address spoofing, allowing unauthorized access by impersonating trusted hosts.
- No support for modern access controls or strong identity verification.
Common Mitigations:
- Completely disable RSH services on all hosts; replace with SSH where possible.
- Remove or tightly restrict any
rhostsorhosts.equivtrust files if RSH must remain enabled. - Implement strict network segmentation/isolation to minimize exposed RSH attack surfaces.
- Monitor network traffic for unauthorized use of port 514 and unusual remote command activity.
- Apply host firewalls to block inbound TCP port 514 requests except from explicitly trusted sources (preferably none).
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted