{
  "port": 106,
  "protocol": "tcp",
  "service": "poppassd (registered: 3COM-TSMUX)",
  "oneLiner": "Registered to 3COM-TSMUX, but in practice this is poppassd — cleartext mail password changes.",
  "whatItIs": "IANA assigns 106 to `3com-tsmux`, a long-dead 3Com terminal-server multiplexer. What actually listens on 106 today is poppassd, a password-change daemon spoken by mail servers and control panels: the client sends `user`, `pass`, then `newpass`, and the daemon changes the account password through PAM. Qualcomm Eudora's \"Change Password\" button drove it, and mail hosting stacks kept it for webmail password changes. The exchange is entirely plaintext, which is why its own manual page tells you to bind it to loopback.",
  "exposure": {
    "verdict": "never",
    "note": "poppassd carries the old and the new password in cleartext; the upstream manual page recommends loopback-only access with everything else blocked."
  },
  "checkCommand": "sudo lsof -nP -iTCP:106 -sTCP:LISTEN",
  "links": [
    {
      "title": "poppassd(8) manual page (Debian)",
      "url": "https://manpages.debian.org/testing/poppassd/poppassd.8.en.html",
      "kind": "official-docs"
    },
    {
      "title": "poppassd-ceti source repository",
      "url": "https://github.com/kravietz/poppassd-ceti",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}