Should ports be visible to nmap?

Question

I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap scan of the FTP-server.

The scan reveals more than a 100 open ports. Is this a security vulnerability? Is there a way to hide these ports from nmap while still being open? Should these ports be filtered out?

Some of the ports are: ssh, http, https, socks, ftp, postgresql and some of the ports are labeled as unknown.

Answer 1

No, you cannot hide a open port in any sensible way. The port accepting connections is what nmap tests, and is also the definition of an open port.

It may or may not be a security risk, and it may or may not be desirable. This depends on your needs and applications. If you don't run a webserver, there's no reason to leave it open. If you don't intend for postgresql to be reachable externally, there's no reason to allow it, and so forth.

You should allow only the traffic you need, and block other traffic. Which traffic this is you have to define yourself.

Answer 2

You can also insert rules in your firewall to only allow access to certain ports from certain network addresses or network address ranges. Perhaps your postgresql server should only be accessible by your developers, you could restrict that port to just the ISPs that your developers use. It's an increased administration burden but may be appropriate for some people.

It's unrelated but I'd also like to suggest migrating from ftp to sftp. sftp has the happy position of being both more secure and easier to use than ftp for most people. (With the exception being anonymous ftp, but http has mostly replaced this use case.)