I am getting ready to run my first server.
I will use ufw to disable every port except port 22 for ssh and port 80 for http.
I am curious though. Suppose theoretically I left every port open except the ssh port and the ftp port. Without ssh and ftp is there any other service or protocol that allows a hacker to gain access to my server? Also assume the culprit has no direct physical access to my server.
You're confusing ports, services, vulnerabilities, and exploits. So here is an analogy based on a house. You have a house (server) on a street. That house has three doors (ports), which lead to different places (services). Just because you have doors (ports), doesn't mean someone is going to walk in and steal your jewelry. Ports are opened because a service needs them to be opened for interconnection between a client, and a server. Not all services are vulnerable, and even those that are vulnerable, aren't exploitable.
For example, in the house analogy, having a door is a vulnerability however, having a door which leads to say another locked door in a foyer removes the exploitability of a thief getting ahold of your jewelry. There can be other parameters: A thief GETS IN the door, but is now trapped in a foyer, and also staring down a vicious dog (honeypot, jailed environment). Get the picture?
If you're concerned about running a webserver, spend some time looking at the versions of software you're going to use, then look for exploits, and or vulnerabilities at NIST using a CVE search. Otherwise the approach you are taking is wrong. Just because you have a house with windows, doesn't mean someone is going to, or can break them, walking away with the keys to the kingdom like Ocean's Eleven
You would need to audit the security of the services running on the ports to have a good idea how exploitable you are. Even then, your typical vulnerability scanner will only make suggestions based on what versions of what services you may be running. The vectorability is something which can be audited, but generally speaking is best left to professionals these days.
Depending on what the server is going to do, there are a number of companies out there that provide audits at varying levels of cost. If you're not a commercial project as of yet, Nessus has a community edition that can get you going on the automated route.
A reasonable system administrator assumes he/she is always compromised and approaches their security under that assumption.
