CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// DevOps, cloud & containers

Port 2379: etcd

etcd client API, the key-value store holding the whole Kubernetes cluster state (including secrets).

2379

How etcd works

DevOps, cloud & containers
adminhostPUT /registry adminhostPUT /registry

Commands sent to port 2379 create and control containers or cluster resources on the host. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.

Transport
TCP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
DevOps, cloud & containers
01 Security

Is port 2379 dangerous?

Common attacks and weaknesses

  • Without client certificate authentication, every Kubernetes secret can be read.

How to secure it

  • Require mutual TLS and restrict to control-plane nodes.
02 Registry

IANA registry entries for port 2379

ServicePortTransportDescriptionReferenceUpdated
etcd-client 2379 TCP etcd client communication - 2014-07-09
-2379-Reserved--

// source: IANA service name and port number registry

03 Check it

Which program uses port 2379, and is it reachable?

Linux

sudo ss -ltnup 'sport = :2379'      # process listening on 2379
sudo lsof -nP -i :2379

macOS

sudo lsof -nP -i :2379

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2379 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 2379
netstat -ano | findstr :2379

From another machine

nmap -p 2379 -sV <host>
nc -zv <host> 2379

Block it in the firewall

sudo ufw deny 2379/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 2379" -Direction Inbound -LocalPort 2379 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 2379 used for?

etcd client API, the key-value store holding the whole Kubernetes cluster state (including secrets).

Is port 2379 TCP or UDP?

Port 2379 is registered for TCP.

Is it safe to open port 2379?

It is rated 9/10 (critical) when exposed to the Internet. Without client certificate authentication, every Kubernetes secret can be read. Require mutual TLS and restrict to control-plane nodes.

How do I check if port 2379 is open?

On Linux run "ss -ltnup 'sport = :2379'", on macOS "lsof -nP -i :2379", and on Windows "netstat -ano | findstr :2379" to see the local process. From another machine, "nmap -p 2379 <host>" shows whether it is reachable.

05 Related
:2375 Docker API (HTTP) tcp · critical risk :2376 Docker API (TLS) tcp · high risk :6443 Kubernetes API tcp · udp · high risk :10250 Kubelet API tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp

Latest vulnerability news

All news