# WHATPORT(901)

## NAME

port 901 — SWAT (Samba Web Administration Tool) — historical — Samba's old SWAT web admin interface; Samba removed it in 4.1.0, so a live 901 today is usually something else.

Protocol: TCP  
IANA: smpnameres

## DESCRIPTION

SWAT was a small CGI web interface for editing smb.conf and starting/stopping Samba, run out of inetd or xinetd on port 901 and protected by HTTP Basic authentication over an unencrypted connection by default. Samba's 4.1.0 release notes list it under removed components, so no current Samba install listens here. IANA's actual registration for 901 is smpnameres, unrelated, and nmap's service table also notes ISS RealSecure using this 901–903 neighbourhood. On a modern scan, 901 is an unidentified service until you look at what it answers.

## EXPOSURE

**Do not expose.** SWAT accepted the root password over cleartext HTTP and could rewrite smb.conf on submission — if you have found a real one, it is a remote root path, and an unidentified listener here deserves the same suspicion.

## CHECK

```sh
curl -sI --max-time 5 http://TARGET:901/
```

## SEE ALSO

- docs — [Samba 4.1.0 release notes — "The Samba Web Administration Tool (SWAT) has been removed"](https://www.samba.org/samba/history/samba-4.1.0.html) (samba.org)
- docs — [Samba 3 HOWTO — SWAT: The Samba Web Administration Tool (port 901)](https://www.samba.org/samba/docs/old/Samba3-HOWTO/SWAT.html) (samba.org)
- iana — [IANA port registry — 901](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=901) (iana.org)
- source — [samba-team/samba](https://github.com/samba-team/samba) (github.com)

---

HTML: <https://whatport.net/901/> · JSON: <https://whatport.net/901.json> · full dataset: <https://whatport.net/ports.json>