Port 88: Kerberos

What uses port 88

Kerberos issues tickets that let users authenticate to services without sending their password over the network. Every Active Directory domain controller runs a Kerberos KDC on port 88, so Windows logins, file shares and many enterprise apps depend on it. Clients need to reach it over both UDP and TCP.

Should port 88 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Kerberos fails if clocks differ by more than 5 minutes by default. “Clock skew too great” errors are fixed by syncing time (NTP, port 123).

Check what is listening on port 88

sudo ss -ltnp 'sport = :88'
sudo ss -lunp 'sport = :88'

sudo lsof -nP -iTCP:88 -sTCP:LISTEN
sudo lsof -nP -iUDP:88

Get-NetTCPConnection -LocalPort 88 -State Listen
Get-NetUDPEndpoint -LocalPort 88
netstat -ano | findstr :88

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 88

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:88 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 88 -State Listen).OwningProcess

Allow port 88 from trusted networks only

The examples allow 88 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 88 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 88 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 88 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="88" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="88" protocol="udp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Kerberos 88/TCP" -Direction Inbound -Protocol TCP -LocalPort 88 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "Kerberos 88/UDP" -Direction Inbound -Protocol UDP -LocalPort 88 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 88 from another machine

nc -zv example.com 88

Test-NetConnection example.com -Port 88

Related ports

• Port 389 (LDAP): used by LDAP for directory lookups and authentication, including Active Directory.
• Port 445 (SMB): used by SMB for Windows file and printer sharing.
• Port 123 (NTP): used by NTP, the Network Time Protocol, to keep clocks in sync.
• Port 636 (LDAPS): used by LDAP over TLS (LDAPS) for encrypted directory access.

More network services ports

53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 853 (DNS over TLS) , 1080 (SOCKS proxy) . See all ports in the port lookup.

Sources

• IANA port registry: 88

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions