1

I heard, that it would be possible to get man-in-the-middle-attacked this way, but the details are not clear to me.

Is it dangerous to use ports above 1024 for things like SSL? And why?

5

I think you are mixing up two things:

  • A man-in-the-middle attack happens outside your computer in the network. All ports are in principle vulnerable against such attacks, unless you use a secure protocol on them
  • Only the root user can bind to the lower ports (up to 1023), but any user can bind to the other ports. Therefore, you usually don't want to use a higher port for things like ssl.
  • So what is the danger if you use a higher port for ssl? – rubo77 Sep 26 at 12:43
  • 1
    When your SSL server is a multi-user machine, any user can try to bind to the higher SSL port and capture the incoming traffic on that port with all consequences like reading usernames and passwords in plain text (unencrypted). A hacker has only to get "normal" access instead of root access to the machine. – jknappen Sep 26 at 12:47
0

Especially for SSH, the use of a port above 1024 is no problem at all.

This is because on the one hand, that one jeopardizes only the client, which is the site that is usually hardly worthy of protection, and, on the other hand, there are the SSH host keys for such scenarios. These are only readable by root. Therefore, without root access, it is not possible to impersonate an SSH server that does not warn the client about wrong host keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.