106 Rsync, 110 NFS and 1771 SMB Results: The File Transfer Layer Nobody Inventories
File sharing protocols are the oldest continuously running services on most networks, and they are rarely part of an attack surface review. A ZoomEye query set collected on 22 September 2026 returned:
| Query | Total results |
|---|---|
port:445 (SMB) |
1,771 |
port:2049 (NFS) |
110 |
port:873 (rsync) |
106 |
The counts are small compared with web or remote-access protocols, and the impact per exposed service is high. A reachable file share is a direct data path, not a foothold that requires further exploitation.
SMB: the largest count and the longest history
SMB on port 445 is the Windows file sharing protocol. The indexed count of 1,771 reflects a protocol that is present on every Windows host and on a large number of NAS appliances and Linux servers running Samba.
The exposure is usually a host with port 445 reachable from the internet. The historical significance is that SMB has been the delivery mechanism for several of the most consequential worms, including the one that used the vulnerability patched as MS17-010. The protocol is also the primary target for credential relay and password spraying, because it accepts authentication attempts and returns distinguishable errors.
The controls are network placement and protocol version. SMB should not be reachable from the internet. Where it must be reachable across a network boundary, SMB signing should be required, and the legacy SMBv1 protocol should be disabled.
NFS: export permissions are the whole control
NFS on port 2049 has no authentication in its base design. Access control is by client IP address and by the export configuration. That model works on a trusted network and fails completely when the service is reachable from an untrusted one.
An NFS export configured with no_root_squash and a permissive client range is a full filesystem access path. The no_root_squash option means that a client presenting root credentials is treated as root on the server, which removes the last barrier.
The indexed count of 110 is small, and the configuration check is specific: read the export table, confirm the client ranges, and confirm that root squashing is enabled.
Rsync: a file transfer daemon with an anonymous mode
Rsync on port 873 is a file synchronisation service. Its daemon mode supports a module configuration where a module can be published without authentication, which is a deliberate feature for distributing public content and an accidental exposure when used for anything else.
An rsync module with no authentication and a read-write path is a file upload and download channel. The indexed count of 106 is the smallest in this set, and the exposure is usually a single misconfigured module rather than a systemic issue.
The control is the module configuration: authentication where the module is not intended to be public, and read-only where write access is not required.
Why these services persist
File sharing protocols are rarely the subject of a migration project. They are configured once, they work, and they are not revisited. The three services in this dataset share a pattern: a design assumption of a trusted network, a configuration that is easy to leave permissive, and no strong authentication in the base protocol.
That combination means the exposure is usually a network boundary problem rather than a software vulnerability. The fix is a firewall rule or a network segmentation change, not a patch.
What to check in your own estate
- Query your own netblocks for 445, 2049 and 873. Any result is a finding.
- Read the export and module configuration. For NFS, the client ranges and root squashing setting. For rsync, the authentication and read-write flags.
- Check SMB signing and protocol version. SMB signing prevents relay; SMBv1 should be disabled entirely.
- Check the data classification. A file share on a marketing network is a different finding from one on a finance or engineering network.
- Check for anonymous access. SMB null sessions, NFS world-readable exports and unauthenticated rsync modules are all anonymous access paths.
Limitations
These figures are a snapshot collected on 22 September 2026. SMB in particular is likely undercounted relative to its installed base, because many SMB services are behind a VPN or a gateway and are not directly reachable.
A reachable file service is not a confirmed data exposure. Confirming that requires reading the share or export configuration, which is a different measurement from a port query.
References
- ZoomEye, cyberspace search engine. Query set:
port:445,port:2049,port:873; collected 22 September 2026. - IANA, Service Name and Transport Protocol Port Number Registry.
- Microsoft, SMB security enhancements and SMB signing guidance.
- IETF, RFC 8881: Network File System (NFS) Version 4 Minor Version 1 Protocol.
- rsync, rsyncd.conf manual page.
