0

Port 25 of a web server is open. We dont have any email server, since we use google mail server, but still port 25 is open. Is it dangerous to keep it open?

If it can be attacked then how it can be attacked?

  • 1
    Are you using shared hosting? In this case someone else on the same server might be running an email server. – André Borie Jul 17 '17 at 3:09
  • There is a chance that SMTP is being used legitimately to send email for whatever the service is that is running on the server. (I.e. to send notifications to admins, to email users etc.) There is also a chance that it is being used for more malicious purpose. Have you confirmed what service is actually running on the port 25. What version of the protocol that is running? If the service on the server is making use of SMTP? Etc. etc. Without that information it is difficult to answer your question. – TheJulyPlot Jul 17 '17 at 6:47
4

I think sometimes people are confused with the word open (in a similar context), maybe imagining like having an open door in the house. Or maybe thinking that if something is open, than for hacker it must be easy to get into the system.

Having an open port doesn't necessarily mean that hacker can simply hack-it. If a service which runs behind that open port is somehow vulnerable than that can mean an open way for hacker.

And lastly, if you are not using that port than simply you can close it.

  • makes sense....got t :) – Abhinav Jul 31 '17 at 6:26
1

The rule is: if you do not use it, it should not be kept open. Without more info, it is hard to say whether it can cause harm to the web server. The risk is that as you do not use it, you will not audit and patch it. So if if vulnerability is later discovered, it will affect the machine hosting the web server.

TL/DR: best security practices recommend to close all ports that are not required.

0

For all intents and purposes, port 25 is primarily used for SMTP, which is an email protocol. Depending on what MX records are set as and what ports you have working in iptables and/or firewall it's generally not an issue. However, if you have some type of misconfiguration you may leave your web server vulnerable to hackers trying to spoof your web server.

  • The big threat with a misconfigured SMTP port is that someone might 'spoof' the web server? I'm not sure I understand what you mean by 'spoof' in this instance. – schroeder Jul 17 '17 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.