Port 873 (rsync): Uses and Security

What uses port 873

An rsync daemon (rsync --daemon) serves modules on port 873, typically for public mirrors of Linux distributions and open source projects. The daemon protocol isn’t encrypted. For private data, run rsync over SSH instead (rsync -az src/ user@host:dest/), which uses port 22 and needs no daemon.

Should port 873 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

An rsync daemon with modules that don’t require authentication lets anyone download, and sometimes overwrite, the files. Check auth users and read only in rsyncd.conf.

Check what is listening on port 873

Linux

sudo ss -ltnp 'sport = :873'

macOS

sudo lsof -nP -iTCP:873 -sTCP:LISTEN

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 873 -State Listen
netstat -ano | findstr :873

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 873

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:873 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 873 -State Listen).OwningProcess

Allow port 873 from trusted networks only

The examples allow 873 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 873 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 873 proto tcp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="873" protocol="tcp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "rsync 873/TCP" -Direction Inbound -Protocol TCP -LocalPort 873 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 873 from another machine

macOS / Linux

nc -zv example.com 873

Windows (PowerShell)

Test-NetConnection example.com -Port 873

Related ports

Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.
Port 21 (FTP): the control port of FTP, the File Transfer Protocol.
Port 2049 (NFS): used by NFS, the Network File System.

More file sharing ports

20 (FTP data) , 69 (TFTP) , 139 (NetBIOS Session) , 445 (SMB) , 990 (FTPS) . See all ports in the port lookup.

Sources

IANA port registry: 873

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 873 used for?

Port 873 is used by the rsync daemon for file synchronization. An rsync daemon (rsync --daemon) serves modules on port 873, typically for public mirrors of Linux distributions and open source projects. The daemon protocol isn’t encrypted. For private data, run rsync over SSH instead (rsync -az src/ user@host:dest/), which uses port 22 and needs no daemon.

Is it safe to open port 873?

Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 873 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :873'" on Linux or "sudo lsof -nP -i :873" on macOS. From another machine, run "nc -zv host 873" or, on Windows, "Test-NetConnection host -Port 873". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.