{
  "port": 1098,
  "protocol": "tcp",
  "service": "Java RMI activation (rmid)",
  "oneLiner": "The RMI activation daemon's internal registry — a removed Java feature that still shows up on old JBoss and legacy JVM stacks.",
  "whatItIs": "Running `rmid` started the Java RMI activation system and, per Oracle's documentation, \"starts the Activator and an internal registry on the default port 1098\" with an ActivationSystem bound into it. RMI Activation was deprecated in Java SE 15 and removed outright in Java SE 17 by JEP 407, so anything listening here is running an old JVM or an old application server. In practice 1098 most often turns up next to 1099 on legacy JBoss deployments, which used it for naming-service RMI callbacks to client proxies.",
  "exposure": {
    "verdict": "never",
    "note": "It is a Java RMI endpoint that deserializes attacker-supplied objects; RMI ports reachable from untrusted networks are a standard remote-code-execution path."
  },
  "checkCommand": "nmap -Pn -p 1098 --script rmi-dumpregistry TARGET",
  "links": [
    {
      "title": "The rmid Command (Java SE 16 tool specification)",
      "url": "https://docs.oracle.com/en/java/javase/16/docs/specs/man/rmid.html",
      "kind": "official-docs"
    },
    {
      "title": "JEP 407: Remove RMI Activation",
      "url": "https://openjdk.org/jeps/407",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}