{
  "port": 544,
  "protocol": "tcp",
  "service": "kshell (Kerberized rsh)",
  "oneLiner": "Kerberized rsh — remote command execution authenticated by Kerberos ticket.",
  "whatItIs": "IANA registers TCP 544 as \"kshell\", described simply as krcmd: the Kerberos version of rsh, which runs a single command on a remote host using a Kerberos ticket in place of the .rhosts host trust that plain rsh on 514 uses. Like klogin on 543, it came from the Kerberized application suite that MIT moved out of the krb5 core distribution in release 1.8, and it has been superseded by SSH with GSSAPI authentication. Seeing it open points at a legacy Kerberos realm or an old commercial Unix box.",
  "exposure": {
    "verdict": "never",
    "note": "Remote command execution on an unmaintained service, and the surrounding realm is likely just as old. Nothing about this belongs on a public address."
  },
  "checkCommand": "nc -vz -w 3 TARGET 544",
  "links": [
    {
      "title": "MIT krb5 source repository",
      "url": "https://github.com/krb5/krb5",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 544",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=544",
      "kind": "iana"
    }
  ]
}