{
  "port": 60020,
  "protocol": "tcp",
  "service": "Apache HBase RegionServer RPC (pre-0.99 default)",
  "oneLiner": "An older Apache HBase cluster — the RegionServer RPC port before HBase moved off it.",
  "whatItIs": "Through HBase 0.98, `hbase.regionserver.port` defaulted to 60020, the RPC endpoint clients hit to read and write region data, with the RegionServer's web UI on 60030 and the Master on 60000/60010. HBASE-10123, \"Change default ports; move them out of linux ephemeral port range\", moved all of them into the 160xx block for 0.99.0 — 16020 for the RegionServer — precisely because 600xx collides with the Linux ephemeral range and a RegionServer could fail to bind after another process grabbed its port first. So a live 60020 today means either an HBase cluster older than 0.99 or a newer one explicitly configured back to the legacy port. The number itself is unregistered; IANA assigns nothing above 49151 under RFC 6335.",
  "exposure": {
    "verdict": "never",
    "note": "HBase RPC is an internal cluster plane, unauthenticated unless Kerberos is configured, and a reachable RegionServer means reachable data. Keep it on a private network."
  },
  "checkCommand": "nmap -Pn -sV -p 60020 TARGET",
  "links": [
    {
      "title": "HBASE-10123 — Change default ports; move them out of linux ephemeral port range",
      "url": "https://issues.apache.org/jira/browse/HBASE-10123",
      "kind": "official-docs"
    },
    {
      "title": "The Apache HBase Reference Guide (hbase.regionserver.port)",
      "url": "https://hbase.apache.org/book.html",
      "kind": "official-docs"
    },
    {
      "title": "apache/hbase",
      "url": "https://github.com/apache/hbase",
      "kind": "github"
    }
  ]
}