Port 2105 – eklogin / MSMQ RPC (Kerberos Encrypted rlogin)

Port 2105 is best known by the service name eklogin — the encrypted Kerberos login, an encrypted, Kerberos-authenticated version of the old Unix rlogin service (the “e” is for encrypted). It belongs to MIT’s Kerberized r-services family, alongside klogin on 543 and kshell on 544. That name is a traditional Unix /etc/services and MIT Kerberos convention rather than a formal IANA assignment — IANA actually registers 2105 to MiniPay, an obscure, long-defunct micropayment system. In practice, neither is what you usually find: on a modern Windows network an open TCP 2105 is almost always one of the RPC ports used by Microsoft Message Queuing (MSMQ). MSMQ’s main listener is TCP 1801, but it also binds fixed RPC ports 2103, 2105, and 2107 for remote queue reads and management, located via RPC on port 135. So when 2105 turns up on a scan, the real question is whether you’re looking at a vestigial eklogin label or an MSMQ-enabled Windows host — and it’s nearly always the latter.

Why It’s Open

• MSMQ is installed, usually unintentionally. By far the most common reason 2105 is open. MSMQ ships as an optional Windows feature but is pulled in silently by Exchange, Dynamics, and older .NET apps; once mqsvc.exe runs it binds 1801 plus the RPC ports 2103/2105/2107. The full MSMQ picture lives on port 1801.
• It rarely travels alone. An MSMQ host almost always exposes RPC 135 and TCP 1801 next to 2105, and usually 2103 and 2107 — that cluster is the tell.
• Legacy eklogin assignment. The eklogin name lingers in /etc/services and scanner databases, so a tool may still label 2105 “eklogin” on a Windows host that has never run a Kerberos login daemon.
• Genuine eklogin is rare. Real encrypted-rlogin deployments survive mostly in academic, MIT-Athena-derived Kerberos networks; the service has been superseded by SSH almost everywhere, so actual eklogin traffic is the exception, not the rule.

Common Risks

• It confirms an MSMQ attack surface. On Windows, an open 2105 is a strong signal that MSMQ is enabled — which since 2023 means exposure to the MSMQ vulnerability cluster. The remote-code-execution risk lives on the MSMQ protocol itself, not on 2105, so the finding here is “MSMQ is present — go assess it on 1801.”
• RPC remote reads and management. 2103 and 2105 carry RPC-based remote reads of public and private queues, and 2107 exposes remote management APIs. Reachable from an untrusted network, that widens the MSMQ surface beyond the main 1801 listener.
• Partial firewalling gives false comfort. Because MSMQ spreads across 1801/2103/2105/2107/135, blocking only 1801 can leave the RPC paths open. The whole set has to be restricted together.
• A mislabelled service is a missed finding. A stray “eklogin” label can lead an analyst to dismiss an MSMQ-enabled host. Never trust the port name — confirm the service.
• Legacy remote login, if genuinely present. Real eklogin at least adds Kerberos authentication and session encryption — unlike the plaintext rlogin (513) and rsh (514) it descends from — but it’s obsolete r-services code superseded by SSH and worth retiring.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect and fingerprint the service

nmap -sV -p 2105 <target>

Nmap may print eklogin from its service database — treat that as a guess from the port number, not a verified protocol. On a Windows host it is almost certainly MSMQ.

Scan the full MSMQ port set

nmap -sV -p 135,1801,2103,2105,2107 <target>

If 2105 opens alongside 1801, 135, and 2103/2107, that fingerprint is the clearest sign MSMQ is enabled — pivot to the MSMQ checks on port 1801.

Raw banner grab

nc -nv <target> 2105

A raw connect confirms the port answers and can reveal whether you’re talking to a silent RPC endpoint or a genuine Kerberos login daemon. For real eklogin, the listener is klogind -e (encrypted Kerberized rlogin) and any handshake requires a valid Kerberos ticket, so a plain client gets nowhere without one.

Log every host where you confirm what’s really on 2105, plus its patch state, so the evidence lands in the pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• No CVEs specific to eklogin or port 2105. eklogin is the encrypted member of MIT’s legacy Kerberized r-services (klogind), superseded by SSH and with no notable modern CVE of its own tied to this port. Its only historic exposure is the ancient krb4-era buffer-overflow class in the Kerberos libraries the r-services linked against — long since patched and irrelevant to a modern host.
• The real exposure is MSMQ. If 2105 is open because MSMQ is enabled, the relevant issues are the MSMQ ones — headlined by CVE-2023-21554 (QueueJumper), an unauthenticated remote code execution flaw (CVSS 9.8) patched in April 2023, plus the wider cluster of roughly 20 MSMQ CVEs from that year. These target the MSMQ protocol whose primary listener is TCP 1801, not 2105 (an RPC port) — full detail, detection, and the QueueJumper check live on the port 1801 page.
• Old page claim removed. A previous version of this page cited CVE-2003-0138 as “Kerberos implementation vulnerabilities in encrypted login services.” That is mislabelled: CVE-2003-0138 is a Kerberos 4 protocol chosen-plaintext impersonation weakness (in Heimdal and other krb4 packages), not an eklogin/klogind or port-2105 bug. It has been removed, along with the unverifiable “authentication bypass,” “ticket replay,” and “protocol downgrade” claims that accompanied it.

Mitigation

• If MSMQ is running and unused, disable it. Remove the Message Queuing Windows feature or stop and disable mqsvc.exe, then rescan — this closes 1801 and the 2103/2105/2107 RPC ports together. This is the highest-impact fix, because most exposed MSMQ is an unintended dependency nobody needs.
• Patch and stay current. Apply the April 2023 update that fixed QueueJumper and keep up with later Windows updates — the 2023 MSMQ cluster was patched over several months.
• Firewall the whole MSMQ port set. Restrict TCP 1801, 2103, 2105, 2107, and RPC 135 to trusted application tiers, and never expose any of them to the internet.
• If it’s genuinely eklogin, move to SSH. Retire the Kerberized r-services (eklogin/klogin/kshell) along with plaintext rlogin and rsh; SSH on port 22 is the modern replacement. Otherwise, fingerprint whatever is on 2105 and disable it if it isn’t sanctioned.

Real-World Example

When Check Point Research disclosed QueueJumper (CVE-2023-21554) in April 2023, roughly 360,000 hosts had MSMQ exposed to the internet — and on almost every one, a scan showed the same cluster: TCP 1801 with 135, 2103, 2105, and 2107 beside it. That RPC-port fingerprint, not the QueueJumper packet’s target port, is usually what first tells an auditor MSMQ is enabled. The trap on 2105 specifically is the label: a scanner prints eklogin, an analyst thinks “some old Kerberos login service,” and walks past an MSMQ-enabled Windows box that was one packet away from unauthenticated RCE. Genuine encrypted-rlogin traffic on 2105 does still exist in a handful of academic Kerberos networks — but on a modern corporate network, the port almost always means MSMQ.

FAQ

What is port 2105 used for?

By the traditional /etc/services name, port 2105 is eklogin — encrypted Kerberos rlogin, part of MIT’s legacy Kerberized r-services (its official IANA registration is actually the obscure MiniPay micropayment service). In practice, on a modern Windows network an open 2105 is almost always one of the RPC ports used by Microsoft Message Queuing (MSMQ), which listens on TCP 1801 and binds 2103, 2105, and 2107 for remote queue reads and management.

Is port 2105 an MSMQ port?

Yes — on Windows it usually is. MSMQ’s main listener is TCP 1801, but it also uses fixed RPC ports 2103 and 2105 (and 2107 on MSMQ 3.0+), discovered through RPC on port 135. So an open 2105 sitting next to 1801 and 135 is a strong sign the MSMQ feature is enabled on the host.

What is eklogin?

eklogin is the encrypted Kerberos login service — a version of the old Unix rlogin that adds Kerberos authentication and session encryption (the daemon is klogind -e). It’s the encrypted sibling of klogin (port 543) in MIT’s Kerberized r-services family. It predates and is superseded by SSH, so genuine eklogin is rare today and mostly confined to academic Kerberos environments.

Is port 2105 dangerous?

The port isn’t dangerous by itself, but what it usually indicates can be. On Windows it signals an MSMQ-enabled host, and MSMQ has been affected since 2023 by critical unauthenticated bugs such as QueueJumper (CVE-2023-21554). Treat an open, unexplained 2105 as “confirm MSMQ and assess it on port 1801.”

How do I close port 2105?

If it’s MSMQ and nothing needs it, remove the Message Queuing Windows feature or stop and disable the service, then rescan — that closes 1801 and the 2103/2105/2107 RPC ports at once. If MSMQ is required, patch it and firewall the whole port set to trusted tiers. If it’s genuinely eklogin, migrate to SSH and disable the legacy r-services; if it’s something else, identify the listener and disable it if it isn’t sanctioned.

TL;DR

• Service: eklogin (encrypted Kerberos rlogin) by the legacy /etc/services name — effectively vestigial; IANA officially assigns 2105 to the obscure MiniPay. In practice, an MSMQ RPC port on Windows.
• Default port: 2105/TCP; MSMQ uses it alongside 1801, 2103, 2107, and 135.
• Biggest risk: an open 2105 flags an MSMQ-enabled host — exposure to the 2023 MSMQ CVE cluster (QueueJumper, CVE-2023-21554). There are no eklogin CVEs of its own.
• Mitigation: confirm MSMQ vs eklogin, disable MSMQ if unused, patch, and firewall the whole MSMQ port set (1801/2103/2105/2107/135).