1

I heard, that it would be possible to get man-in-the-middle-attacked this way, but the details are not clear to me.

Is it dangerous to use ports above 1024 for things like SSL? And why?

Improve this question

2 Answers 2

Reset to default
5

I think you are mixing up two things:

  • A man-in-the-middle attack happens outside your computer in the network. All ports are in principle vulnerable against such attacks, unless you use a secure protocol on them
  • Only the root user can bind to the lower ports (up to 1023), but any user can bind to the other ports. Therefore, you usually don't want to use a higher port for things like ssl.
Improve this answer
2
  • So what is the danger if you use a higher port for ssl?
    – rubo77
    Sep 26, 2019 at 12:43
  • 1
    When your SSL server is a multi-user machine, any user can try to bind to the higher SSL port and capture the incoming traffic on that port with all consequences like reading usernames and passwords in plain text (unencrypted). A hacker has only to get "normal" access instead of root access to the machine.
    – Sir Cornflakes
    Sep 26, 2019 at 12:47
0

Especially for SSH, the use of a port above 1024 is no problem at all.

This is because on the one hand, that one jeopardizes only the client, which is the site that is usually hardly worthy of protection, and, on the other hand, there are the SSH host keys for such scenarios. These are only readable by root. Therefore, without root access, it is not possible to impersonate an SSH server that does not warn the client about wrong host keys.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .