Port 88 (Kerberos)

Kerberos authentication, the default login protocol in Active Directory and also used by MIT Kerberos and FreeIPA.

Well-known (system) port, 0-1023 TCPUDP Directory and authentication Do not expose to the internet

What port 88 is used for

Kerberos authentication, the default login protocol in Active Directory and also used by MIT Kerberos and FreeIPA.

Security: should port 88 be open?

Do not expose to the internet. Keep it inside the network. Attacks such as Kerberoasting and AS-REP roasting request tickets to crack service-account passwords offline; use long random service-account passwords or gMSAs.

IANA assignment

Service nameProtoDescriptionAssigneeReference

kerberos TCP Kerberos B Clifford Neuman RFC 4120

kerberos UDP Kerberos B Clifford Neuman RFC 4120

Registry dates for this port: last modified 2022-02-18.

Check what is listening on port 88

Linux: is anything listening on TCP 88?

sudo ss -tlnp 'sport = :88'

Linux: UDP 88

sudo ss -ulnp 'sport = :88'

Linux / macOS: which process owns the port

sudo lsof -nP -i :88

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':88 '

Windows (Command Prompt)

netstat -ano | findstr :88

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 88 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 88

From Windows

Test-NetConnection HOST -Port 88

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 88

Block port 88 in the firewall

ufw

sudo ufw deny 88/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 88 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 88 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 88' -Direction Inbound -Protocol TCP -LocalPort 88 -Action Block

ufw

sudo ufw deny 88/udp