Common attacks and weaknesses
- Without client certificate authentication, every Kubernetes secret can be read.
Port 2379: etcd
etcd client API, the key-value store holding the whole Kubernetes cluster state (including secrets).
2379
How etcd works
DevOps, cloud & containersCommands sent to port 2379 create and control containers or cluster resources on the host. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP
- Exposure risk
- 9/10 critical if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- DevOps, cloud & containers
Is port 2379 dangerous?
How to secure it
- Require mutual TLS and restrict to control-plane nodes.
IANA registry entries for port 2379
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| etcd-client | 2379 | TCP | etcd client communication | - | 2014-07-09 |
| - | 2379 | - | Reserved | - | - |
// source: IANA service name and port number registry
Which program uses port 2379, and is it reachable?
Linux
sudo ss -ltnup 'sport = :2379' # process listening on 2379
sudo lsof -nP -i :2379macOS
sudo lsof -nP -i :2379
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 2379 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 2379 netstat -ano | findstr :2379
From another machine
nmap -p 2379 -sV <host> nc -zv <host> 2379
Block it in the firewall
sudo ufw deny 2379/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 2379" -Direction Inbound -LocalPort 2379 -Protocol TCP -Action Block # Windows
What is port 2379 used for?
etcd client API, the key-value store holding the whole Kubernetes cluster state (including secrets).
Is port 2379 TCP or UDP?
Port 2379 is registered for TCP.
Is it safe to open port 2379?
It is rated 9/10 (critical) when exposed to the Internet. Without client certificate authentication, every Kubernetes secret can be read. Require mutual TLS and restrict to control-plane nodes.
How do I check if port 2379 is open?
On Linux run "ss -ltnup 'sport = :2379'", on macOS "lsof -nP -i :2379", and on Windows "netstat -ano | findstr :2379" to see the local process. From another machine, "nmap -p 2379 <host>" shows whether it is reachable.
Other devops, cloud & containers ports
:2375 Docker API (HTTP) tcp · critical risk :2376 Docker API (TLS) tcp · high risk :6443 Kubernetes API tcp · udp · high risk :10250 Kubelet API tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp