Since port 80 is typically used for HTTP must a web server have it open or otherwise configure links to specify a different port (e.g. http://www.example.com:8080/mypage.html)? For example this site doesn't have any port specified in its URL so does that mean the stack exchange web server has port 80 open? Is it seen as a potential security problem because now an attack can be directed at port 80?
Add a comment
|
2 Answers
For example this site doesn't have any port specified in its URL so does that mean the stack exchange web server has port 80 open?
Yes. If you dont specify a port for the HTTP protocol, port 80 is used. Port 443 is used for SSL.
Is it seen as a potential security problem because now an attack can be directed at port 80?
Security always comes with tradeoffs. If port 80 weren't open, none of us could see the website. A store with nothing in the register can't be robbed of cash, but it can't make change for purchases either.
Open ports are usually only considered a problem when they're unintentional, unnecessary, or a result of many unsegregated services on one host were a compromise of one service exposing the backend of another service is a risk.
To answer the title line of your question: Closing port 80 is a problem when you want to run a web service unless you're willing to use a non-standard port. In that case, links will need to be re-written if they're not relative links. Absolute links will have to include a non-standard port number.
answered Nov 25, 2012 at 5:19
-
1Plus, the web server listening on port 80 has to have a vulnerability to be exploited. The likelihood of this happening can be greatly reduced by applying patches on a regular basis.– user10211Nov 25, 2012 at 5:33
-
Would it increase security to use a different port for the web servers? I don't see it being too much work to add :8080 or whatever to every link. I guess not really because it's still an open port but at least an attacker would have to check all ports and not assume port 80 is open. Nov 25, 2012 at 5:38
-
@Celeritas It might, but it probably won't. My first reaction to a site that needs me to type ":8080" at the end of the link would be to never visit it ever again. Plus it won't stop anyone who is doing a comprehensive port scan of your network from finding which port your HTTP server is running on.– user10211Nov 25, 2012 at 5:47
-
-
1Placing a site on a non-standard port number is essentially 'security through obscurity.' You are counting on others not knowing that your site exists as a means of protection.– user16430Nov 26, 2012 at 23:23
It doesn't matter which port is open. An attacker would do a port scan and by then he would have known which services are running on which port. And if he sees some services that are easily exploitable, then obviously he would want to exploit it, be it port 80 or some random port.
