Port 5555 ADB · TCP

What runs on port 5555

Android Debug Bridge over TCP (adb tcpip 5555). On a phone or Android TV box left in this state and reachable, anyone can install apps and open a shell as the shell user without any authentication prompt after the first pairing. Scanners find thousands of such devices; it is also the default port of several other tools (Oracle WebLogic admin in some setups, Flower for Celery).

Software that uses it: Android (adbd) · Android TV boxes · Flower (Celery monitoring)

Should port 5555 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• adb connect host:5555 is the test; if it succeeds without a prompt, the device is open.
• Run adb usb to switch back, and keep debugging off on devices you do not develop on.

Check port 5555

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :5555'
sudo lsof -i :5555

# from another machine: is it reachable?
nc -zv host 5555
nmap -p 5555 host
curl -v telnet://host:5555      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 5555

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 5555 proto tcp
sudo ufw deny 5555/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 5555 accept
nft add rule inet filter input tcp dport 5555 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 5555 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5555 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=5555 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 5555" with no source is just "open".

Putting it behind nginx

server {
    listen 443 ssl;
    server_name app.example.com;
    location / {
        proxy_pass http://127.0.0.1:5555;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Then make the application listen on 127.0.0.1:5555 only. Test which location block a request hits with the nginx location tester.

Related ports

• 23 Telnet — Plaintext remote shell; should be off

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions