whatportis.com
suggest an edit →

Port 752Kerberos kpasswd Server

**Kerberos Password Change (kpasswd) Server** — Port 752 is primarily used by the Kerberos authentication protocol to handle password changes securely. The service facilitates secure communication between clients wishing to update their passwords and the Kerberos authentication infrastructure, maintaining strong user identity management within enterprise environments..

inSecuritySystem
transport
udp

single transport

in transit
cleartext

payload readable on path

assignment
unofficial

used by convention

risk
2/10

safe

lookups
7,284

rank 707 of 993 · top 71%

1 other service is registered on port 752. compare all 2 →

Technical Details

what runs on :752

Overview

Port 752 is designated for the Kerberos Password change service, commonly referred to as kpasswd. It supports client requests to change Kerberos principal passwords by securely transmitting the password-change request to the Kerberos Key Distribution Center (KDC). Because Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications, managing credentials like user passwords is crucial to its overall security model.

Functionality

When a client initiates a password change, it communicates over UDP port 752 to send an encrypted kpasswd request to the KDC, often to a dedicated password-changing daemon such as kpasswdd. This ensures that the old password is verified before securely updating the principal’s secret stored within the Kerberos database. The operation uses secure encryption methods supported by Kerberos to protect the sensitive data during transmission.

Protocol Considerations

Typically, port 752 operates over UDP due to its lower overhead and suitability for small, discrete requests like password changes. It is important to note that while this port is unofficial and lacks a formal IANA designation, it is widely adopted in Kerberos deployments for password management, complementing the standard Kerberos (port 88) and administration protocols (port 749).

Security Information

exposure of :752

risk score

2/ 10safe

routine exposure. this port is rarely the way in on its own — keep it patched and logged and move on.

security averages 3.8 across 216 ports — this one sits 1.8 below.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities

  • Replay attacks if timestamp validation or encryption is improperly handled.
  • Brute-force attacks against password change requests if weak passwords are permitted.
  • Man-in-the-middle attacks during initial negotiation phases if mutual authentication fails.
  • Denial-of-service (DoS) via flooding the service with malformed or excessive requests.

Mitigations

  • Enforce strong password complexity policies and rate limiting for password change attempts.
  • Use Kerberos pre-authentication with appropriate encryption algorithms.
  • Restrict access to port 752 to trusted internal networks via firewall rules.
  • Monitor logs and use intrusion detection to flag suspicious password change behaviors.
  • Apply timely patches and security updates to Kerberos infrastructure components.
  • Employ network segmentation to isolate authentication services from direct user access.

Related Ports

all 216 in security →

the 8 most looked-up other ports in security — 216 ports carry that label.

portservicerisk
:8881Atlasz Secure Servercaution
:443HTTPScaution
:8291Winbox MikroTik Admincaution
:3268Microsoft Global Catalog (GC)caution
:135Microsoft EPMAPcaution
:3128Squid Proxy HTTPcaution
:8080HTTP Alternatecaution
:7000Vuze HTTPS Trackercaution

risk mix of the 8 listed

  • caution100%

3 of 8 encrypted