CyberHunter
Local dataset, no network
// DevOps, cloud & containers

Port 6443: Kubernetes API

Kubernetes API server.

kube-apiserver
6443

How Kubernetes API works

DevOps, cloud & containers
adminhostkubectl apply adminhostkubectl apply

Commands sent to port 6443 create and control containers or cluster resources on the host. Everything is encrypted: someone on the path only sees unreadable bytes.

Transport
TCP · UDP
Exposure risk
7/10 high if reachable from the Internet
Encryption
EncryptedTLS or built-in crypto
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
DevOps, cloud & containers
01 Security

Is port 6443 dangerous?

Common attacks and weaknesses

  • Anonymous access or overly broad RBAC giving cluster control.
  • Leaked kubeconfig files and service account tokens.

How to secure it

  • Disable anonymous auth and audit RBAC.
  • Restrict the API endpoint to admin networks or a private endpoint.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 6443

ServicePortTransportDescriptionReferenceUpdated
sun-sr-https 6443 TCP, UDP Service Registry Default HTTPS Domain - 2006-03

// source: IANA service name and port number registry

03 Check it

Which program uses port 6443, and is it reachable?

Linux

sudo ss -ltnup 'sport = :6443'      # process listening on 6443
sudo lsof -nP -i :6443

macOS

sudo lsof -nP -i :6443

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 6443 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 6443
netstat -ano | findstr :6443

From another machine

nmap -p 6443 -sV <host>
sudo nmap -sU -p 6443 <host>
nc -zv <host> 6443

Block it in the firewall

sudo ufw deny 6443/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 6443" -Direction Inbound -LocalPort 6443 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 6443 used for?

Kubernetes API server.

Is port 6443 TCP or UDP?

Port 6443 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 6443?

It is rated 7/10 (high) when exposed to the Internet. Anonymous access or overly broad RBAC giving cluster control. Disable anonymous auth and audit RBAC.

How do I check if port 6443 is open?

On Linux run "ss -ltnup 'sport = :6443'", on macOS "lsof -nP -i :6443", and on Windows "netstat -ano | findstr :6443" to see the local process. From another machine, "nmap -p 6443 <host>" shows whether it is reachable.

05 Related
:2375 Docker API (HTTP) tcp · critical risk :2376 Docker API (TLS) tcp · high risk :10250 Kubelet API tcp · critical risk :2379 etcd tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp

Latest vulnerability news

All news