Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm installing service on the cloud machine and I was wondering on port vulnerabilities for my customers.

My service which lives on server A (often on a customer site) needs to access server B (lives in a cloud) through port 1234. On server B there's a service running on port 1234 but customer often wants to block access to it as non standard port. Server A doesn't have a service running on that port but still needs to be able to communicate on it.

Is there a vulnerability of opening port which is used to establish connection with another service? If you scan a machine A the port would be open but there's nothing running on it.

Typical solution would be enable port 1234 between IP A and IP B but in cloud we can't guarantee the ip addresses.

Cheers, John

share|improve this question
2  
My opinion: This is very difficult to answer as a port is only a mean of transfer of data between two systems. So it all depends if the services using that port are vulnerable or not. Also it seems that even closed ports may be vulnerable: The vulnerability could allow remote code execution if an attacker sends a continuous flow of specially crafted UDP packets to a closed port on a target system. –  HamZa May 12 '13 at 15:05
1  
"if you scan machine A the port would be open but there's nothing running on it". I don't understand. If there is no service, the port will be closed. If machine A connects to a service running on machine B, it won't open any port on machine A. –  void_in May 12 '13 at 15:49
    
I probably should have said that firewall for machine A needs to have port opened not the machine itself. –  John May 12 '13 at 16:29
4  
John, outbound and inbound are very different. The firewall for machine A doesn't need to allow any inbound traffic (except replies, which are usually handled automatically by most firewalls). Just open an outbound port from machine A. –  Rory Alsop May 12 '13 at 16:54

2 Answers 2

An open port is not a security vulnerability in itself. It allows an attacker to connect and exploit any vulnerabilities in the process that's running.

The answer to your question depends on how sure you are in security of your service. Did you ask someone to look at the code? Does it run with limited privileges (not root?). What's the worst that can happen if someone can control this service from the Internet?

Given answers to these questions ("risks"), you need to balance them with benefits from setting it up as you describe and see what you and your customers are comfortable with.

share|improve this answer

As the other person said, open ports themselves are not inherently dangerous, but services running on them may be exploitable. A good practice is to only to open ports that are required for your services to run correctly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.