1

I'm considering developing a web application for my own usage on desktop, running on localhost, automatically launched at startup. I'll need to chose a port to do so. What I'm uneasy about is the ability of any other program to fetch what is available at this port.

I know that this could be considered a virus, but my impression is that listening to a port is something less disturbing than a keylogger for example. Actually an application could already use this port for legitimate purposes.

What are the best practices for choosing a port on localhost (if that's already a practice not so bad) and, if that's possible, securing it?

closed as off-topic by Tobi Nary, Xander, Steve, CaffeineAddiction, Bacon Brad Sep 11 '17 at 21:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Tobi Nary, Xander, Steve, CaffeineAddiction, Bacon Brad
If this question can be reworded to fit the rules in the help center, please edit the question.

1

On Linux, ports below 1024 are called privileged ports. The applications listening on these ports should be privileged. That is, the application should run as root or have the CAP_NET_BIND_SERVICE capability. So, you could use a port greater than 1024.

The common (and IANA assigned) web ports are 80 for HTTP and 443 for HTTPS (HTTP over TLS). The alternative port for HTTP is 8080 which is not a privileged port. You could this.

You could also make sure that the interface your application is listening on is bound to loopback interface.

1

What I'm uneasy about is the ability of any other program to fetch what is available at this port.

For a start, if your server binds to localhost (that's 127.0.0.1 for IPV4, and/or ::1 for IPV6) then only clients running on localhost should be able to access it. If you want to restrict connections to local programs, make sure your server binds to one of those loopback addresses, and definitely not 0.0.0.0 or :: (which denote all interfaces).

If someone has unauthorised access run software which can connect to localhost loopback device, you might have a much bigger problem. I'm going to assume this isn't a problem, meaning unless you're sharing your computer with others, you're safe to just bind to 127.0.0.1 and/or ::1 and be done with it.

You might be sharing your computer with others, i.e. running a shell service, which means you're giving out access to your system. In this case, the ability of one of your (hopefully trustworthy) users to connect to loopback-bound services should be one of the least of your concerns. When you let other people behind your firewall, and into your userland, you give them the ability to probe your entire network! Your router, your printer and any phones you have connected to your network can also run software, and these devices can be much more difficult to secure than your server.

You should consider sandboxing such users using virtualisation such as KVM, Xen, etc, giving them their own virtual environment (including a virtual network interface) to play in and thus giving you the ability to install a firewall on such virtual network interface.


What are the best practices for choosing a port on localhost (if that's already a practice not so bad) and, if that's possible, securing it?

Again, inbound connections from a non-loopback interface should not be able to connect to sockets listening on a loopback interface. If your OS allows such a connection, it's either grossly misconfigured, or it's Windows XP, service pack 1a or below (which is itself a separate problem).

Your main concern should be preventing untrusted users from running code directly in your userland, so if you're sharing your computer with other people, as the administrator, you should sandbox those other people and maintain a finely grained approach at what external stuff they can see. Assuming they're sandboxed, they can only communicate with your host via a virtual network interface, so again, they can't connect to 127.0.0.1 or ::1-bound services on the host, but they might be able to scan your network, still...

0

Check this list of unassigned ports https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
Better choose something after 49k
If you are using socket for IPC, use PF_INET family

Not the answer you're looking for? Browse other questions tagged or ask your own question.