rsync in daemon mode — public mirrors run it on purpose, and so do accidentally exposed backups.
Running rsync --daemon opens TCP 873 and serves named modules defined in rsyncd.conf, each mapping to a directory tree with its own read-only, auth-users and hosts-allow settings. This is the native rsync protocol, not rsync-over-SSH, and modules configured without auth-users are readable by anyone who connects — which is exactly how Linux distribution and CPAN mirrors are meant to work. It is also the classic accidental data leak: a backup module left world-readable, or worse, writable. Listing modules requires no credentials, so a connect immediately tells you what is on offer.
Expose with care
Fine for a deliberate public mirror with read-only modules; anything else needs auth-users, hosts-allow, and a check that no module exports a filesystem root.
$ rsync rsync://rsync.samba.org/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.