The Kerberos admin plane — kadmind, where principals and keys are created and changed.
IANA registers 749 as "kerberos administration", and MIT Kerberos runs kadmind here: the daemon that serves the kadmin protocol for creating principals, changing keys, and editing the KDC database. It authenticates callers with Kerberos itself and enforces an ACL file (kadm5.acl), and it is a different service from the KDC on 88 and from kpasswd on 464. On a scan, 749 next to 88 identifies a KDC — and specifically its administrative interface.
Do not expose
This is the write interface to your realm's identity database; restrict it to admin hosts and keep it off any internet-facing interface.
$ nc -vz TARGET 749Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.