Port 873 (rsync)
File synchronisation daemon.
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- rsync modules without authentication expose whole directory trees, including backups.
When it shows up in your logs
Large outbound rsync transfers can be exfiltration.