# WHATPORT(749)

## NAME

port 749 — kerberos-adm — The Kerberos admin plane — kadmind, where principals and keys are created and changed.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 749 as "kerberos administration", and MIT Kerberos runs kadmind here: the daemon that serves the kadmin protocol for creating principals, changing keys, and editing the KDC database. It authenticates callers with Kerberos itself and enforces an ACL file (kadm5.acl), and it is a different service from the KDC on 88 and from kpasswd on 464. On a scan, 749 next to 88 identifies a KDC — and specifically its administrative interface.

## EXPOSURE

**Do not expose.** This is the write interface to your realm's identity database; restrict it to admin hosts and keep it off any internet-facing interface.

## CHECK

```sh
nc -vz TARGET 749
```

## SEE ALSO

- docs — [MIT Kerberos — kadmind documentation](https://web.mit.edu/kerberos/krb5-latest/doc/admin/admin_commands/kadmind.html) (web.mit.edu)
- source — [MIT krb5 source repository](https://github.com/krb5/krb5) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/749/> · JSON: <https://whatport.net/749.json> · full dataset: <https://whatport.net/ports.json>