{
  "port": 7004,
  "protocol": "both",
  "service": "AFS Authentication Server (kaserver)",
  "oneLiner": "AFS's legacy built-in Kerberos v4 authentication server — long deprecated in OpenAFS.",
  "whatItIs": "IANA registers 7004 as afs3-kaserver, the AFS/Kerberos authentication service. The kaserver was AFS's own Kerberos v4 key distribution centre, issuing the tokens an AFS client needs before a file server will serve it. OpenAFS deprecated it in favour of a real Kerberos 5 KDC (MIT or Heimdal), so a live 7004 usually means an old, unmigrated AFS cell rather than a current deployment. AFS traffic here is Rx over UDP, so a TCP-only scan will typically show nothing even when the service is running.",
  "exposure": {
    "verdict": "never",
    "note": "Kerberos v4 is obsolete and its key exchange is not considered sound; a reachable kaserver is an authentication service that should have been retired, not firewalled."
  },
  "checkCommand": "sudo nmap -sU -p 7004 TARGET",
  "links": [
    {
      "title": "OpenAFS Administration Guide",
      "url": "https://docs.openafs.org/AdminGuide/index.html",
      "kind": "official-docs"
    },
    {
      "title": "OpenAFS source repository",
      "url": "https://github.com/openafs/openafs",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 7004",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=7004",
      "kind": "iana"
    }
  ]
}