TCP 4505
Synopsis
- Salt (aka SaltStack) uses TCP port 4505 on the salt-master as the “publisher” port for its event bus; Salt minions connect to the master on 4505 using ZeroMQ.
- The open-source salt-master packages on common Linux distros (e.g., Ubuntu, RHEL/CentOS via EPEL) listen on 0.0.0.0:4505 by default.
- VMware Aria Automation Config (formerly SaltStack Config), which embeds a Salt master, exposes port 4505 for minion communications.
- SUSE Manager and its upstream project Uyuni, which use Salt as their configuration management backend, run a Salt master that listens on TCP 4505 (and 4506) for managed clients; SUSE Manager Proxy instances do as well.
- Security note: Salt masters on 4505/4506 have been widely targeted due to SaltStack RCE flaws (e.g., CVE-2020-11651/11652), with real-world exploitation to deploy cryptominers and other malware.
Observed activity
Last 30 days
Detailed chart