Port 760: krbupdate — The abandoned Kerberos registration service

Port 760 sits in the well-known ports range with an official assignment, but it carries traffic for a service that barely exists anymore. This is where krbupdate (also known as "kreg," short for Kerberos registration) once lived—a Kerberos Version 4 registration service that modern authentication systems left behind.¹²

What krbupdate Was

In the Kerberos V4 era, krbupdate handled registration tasks for Kerberos authentication infrastructure. It was part of the original suite of Kerberos services designed at MIT in the 1980s to provide network authentication using secret-key cryptography.

The service ran on both TCP and UDP port 760, officially assigned by IANA and documented in RFC 1700 (Assigned Numbers).³ But Kerberos V4 had fundamental security limitations that made it unsuitable for modern networks.

Why It's Obsolete

Kerberos V5 replaced Version 4 in the 1990s, bringing stronger encryption, better ticket management, and more flexible authentication options. When Kerberos V5 became the standard, it brought different services on different ports:

• Port 88: Kerberos V5 authentication (KDC)
• Port 749: Kerberos V5 administration (kadmin)
• Port 754: Kerberos V5 database propagation (kprop/krb5_prop)

The krbupdate service on port 760 became unnecessary. Modern Kerberos deployments don't use it. The port remains assigned in the IANA registry—a nameplate on an office nobody works in.⁴⁵

The Well-Known Ports Range

Port 760 falls in the well-known ports range (0-1023), also called system ports. These ports are assigned by IANA through formal processes requiring IETF Review or IESG Approval. Once assigned, these port numbers rarely change, even when the services they were assigned to become obsolete.

This is why port 760 still carries the krbupdate assignment decades after anyone stopped using it. The registry preserves history even when history stops being useful.

What Runs on Port 760 Today

In practice? Probably nothing.

You might occasionally see port 760 listening on very old Unix systems that still have legacy Kerberos V4 components installed but not removed. You might see it in firewall rules copied forward from ancient configurations. You might see security scanners flag it as "open but unidentified."

But you won't see active krbupdate traffic. That protocol is dead. If you find something listening on port 760, it's either a legacy artifact or something unrelated squatting on an abandoned port number.

Checking What's Actually Listening

On Linux or macOS, check what's using port 760:

sudo lsof -i :760
sudo netstat -tuln | grep 760

On Windows:

netstat -ano | findstr :760

Most systems will return nothing. If something is listening, investigate what it actually is—don't assume it's the officially assigned service.

Why Abandoned Ports Matter

Port 760 is a reminder that the Internet has a long memory. Services die. Protocols get replaced. But the registry keeps their assignments, creating a map of communication history stretching back to the 1980s.

Every obsolete port is a lesson: the protocols we build today might be the abandoned assignments of tomorrow. Authentication moved from Kerberos V4 to V5. Someday it will move beyond V5 to something we haven't invented yet. And when it does, those ports will sit in the registry too, officially assigned to services nobody remembers.

Related Ports

If you're working with Kerberos authentication, you care about the ports that actually matter:

• Port 88: Kerberos V5 KDC (Key Distribution Center)
• Port 749: Kerberos V5 administration (kadmin)
• Port 754: Kerberos V5 database propagation (kprop)
• Port 750: Kerberos V4 KDC (obsolete, like port 760)

Port 760 is where old Kerberos went to rest. The rest of the authentication system moved on without it.