CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// DevOps, cloud & containers

Port 9000: PHP-FPM / SonarQube / Portainer

Shared default of several tools: PHP-FPM FastCGI, SonarQube, Portainer, MinIO.

PHP-FPMSonarQubePortainerMinIO
9000

How PHP-FPM / SonarQube / Portainer works

DevOps, cloud & containers
browser:9000pw=1234 browser:9000pw=1234

A browser sends an HTTP request to port 9000 and the PHP-FPM / SonarQube / Portainer server sends the page back. It travels in clear text: anyone on the path can read it, passwords included.

Transport
TCP · UDP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
DevOps, cloud & containers
01 Security

Is port 9000 dangerous?

Common attacks and weaknesses

  • Exposed PHP-FPM allows remote code execution through FastCGI.
  • Portainer gives control of Docker hosts.

How to secure it

  • Bind PHP-FPM to a Unix socket or localhost; protect admin UIs with strong authentication.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 9000

ServicePortTransportDescriptionReferenceUpdated
cslistener 9000 TCP, UDP CSlistener - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 9000, and is it reachable?

Linux

sudo ss -ltnup 'sport = :9000'      # process listening on 9000
sudo lsof -nP -i :9000

macOS

sudo lsof -nP -i :9000

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 9000 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 9000
netstat -ano | findstr :9000

From another machine

nmap -p 9000 -sV <host>
sudo nmap -sU -p 9000 <host>
nc -zv <host> 9000

Block it in the firewall

sudo ufw deny 9000/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 9000" -Direction Inbound -LocalPort 9000 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 9000 used for?

Shared default of several tools: PHP-FPM FastCGI, SonarQube, Portainer, MinIO.

Is port 9000 TCP or UDP?

Port 9000 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 9000?

It is rated 6/10 (high) when exposed to the Internet. Exposed PHP-FPM allows remote code execution through FastCGI. Bind PHP-FPM to a Unix socket or localhost; protect admin UIs with strong authentication.

How do I check if port 9000 is open?

On Linux run "ss -ltnup 'sport = :9000'", on macOS "lsof -nP -i :9000", and on Windows "netstat -ano | findstr :9000" to see the local process. From another machine, "nmap -p 9000 <host>" shows whether it is reachable.

05 Related
:2375 Docker API (HTTP) tcp · critical risk :2376 Docker API (TLS) tcp · high risk :6443 Kubernetes API tcp · udp · high risk :10250 Kubelet API tcp · critical risk :2379 etcd tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :677 Virtual Presence Protocol tcp · udp

Latest vulnerability news

All news