# WHATPORT(1524)

## NAME

port 1524 — ingreslock — Registered to the Ingres database lock daemon, but famous as the classic UNIX backdoor port.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA assigns 1524 to "ingreslock", the lock manager of the Ingres relational database (now Actian Ingres). Its lasting fame is different: for decades, UNIX rootkits, worms, and hand-placed backdoors have bound an unauthenticated root shell to 1524, because "ingreslock" in a netstat listing looks plausible enough to skim past. Rapid7's Metasploitable 2 ships exactly this as a teaching example — Rapid7's own guide calls it "the old standby 'ingreslock' backdoor that is listening on port 1524", and connecting with telnet drops you at a root prompt with no password. Finding 1524 open on a host that has no Ingres installation is a compromise indicator, not a service.

## EXPOSURE

**Do not expose.** If you did not deliberately install Ingres, an open 1524 should be treated as a live backdoor and investigated as an incident — and even the genuine Ingres lock daemon is an internal database component with no reason to face a network you do not control.

## CHECK

```sh
nmap -Pn -sV -p 1524 TARGET
```

## SEE ALSO

- docs — [Rapid7 — Metasploitable 2 Exploitability Guide (ingreslock backdoor on 1524)](https://docs.rapid7.com/metasploit/metasploitable-2-exploitability-guide/) (docs.rapid7.com)
- docs — [Actian Ingres documentation](https://docs.actian.com/ingres/11.2/index.html) (docs.actian.com)
- iana — [IANA port registry — 1524](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1524) (iana.org)

---

HTML: <https://whatport.net/1524/> · JSON: <https://whatport.net/1524.json> · full dataset: <https://whatport.net/ports.json>