Registered to the Ingres database lock daemon, but famous as the classic UNIX backdoor port.
IANA assigns 1524 to "ingreslock", the lock manager of the Ingres relational database (now Actian Ingres). Its lasting fame is different: for decades, UNIX rootkits, worms, and hand-placed backdoors have bound an unauthenticated root shell to 1524, because "ingreslock" in a netstat listing looks plausible enough to skim past. Rapid7's Metasploitable 2 ships exactly this as a teaching example — Rapid7's own guide calls it "the old standby 'ingreslock' backdoor that is listening on port 1524", and connecting with telnet drops you at a root prompt with no password. Finding 1524 open on a host that has no Ingres installation is a compromise indicator, not a service.
Do not expose
If you did not deliberately install Ingres, an open 1524 should be treated as a live backdoor and investigated as an incident — and even the genuine Ingres lock daemon is an internal database component with no reason to face a network you do not control.
$ nmap -Pn -sV -p 1524 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.