Since port 80 is typically used for HTTP must a web server have it open or otherwise configure links to specify a different port (e.g. http://www.example.com:8080/mypage.html)? For example this site doesn't have any port specified in its URL so does that mean the stack exchange web server has port 80 open? Is it seen as a potential security problem because now an attack can be directed at port 80?
Yes. If you dont specify a port for the HTTP protocol, port 80 is used. Port 443 is used for SSL.
Security always comes with tradeoffs. If port 80 weren't open, none of us could see the website. A store with nothing in the register can't be robbed of cash, but it can't make change for purchases either.
Open ports are usually only considered a problem when they're unintentional, unnecessary, or a result of many unsegregated services on one host were a compromise of one service exposing the backend of another service is a risk.
To answer the title line of your question: Closing port 80 is a problem when you want to run a web service unless you're willing to use a non-standard port. In that case, links will need to be re-written if they're not relative links. Absolute links will have to include a non-standard port number.
|show 2 more comments|
It doesn't matter which port is open. An attacker would do a port scan and by then he would have known which services are running on which port. And if he sees some services that are easily exploitable, then obviously he would want to exploit it, be it port 80 or some random port.