1

Since port 80 is typically used for HTTP must a web server have it open or otherwise configure links to specify a different port (e.g. http://www.example.com:8080/mypage.html)? For example this site doesn't have any port specified in its URL so does that mean the stack exchange web server has port 80 open? Is it seen as a potential security problem because now an attack can be directed at port 80?

3

For example this site doesn't have any port specified in its URL so does that mean the stack exchange web server has port 80 open?

Yes. If you dont specify a port for the HTTP protocol, port 80 is used. Port 443 is used for SSL.

Is it seen as a potential security problem because now an attack can be directed at port 80?

Security always comes with tradeoffs. If port 80 weren't open, none of us could see the website. A store with nothing in the register can't be robbed of cash, but it can't make change for purchases either.

Open ports are usually only considered a problem when they're unintentional, unnecessary, or a result of many unsegregated services on one host were a compromise of one service exposing the backend of another service is a risk.

To answer the title line of your question: Closing port 80 is a problem when you want to run a web service unless you're willing to use a non-standard port. In that case, links will need to be re-written if they're not relative links. Absolute links will have to include a non-standard port number.

  • 1
    Plus, the web server listening on port 80 has to have a vulnerability to be exploited. The likelihood of this happening can be greatly reduced by applying patches on a regular basis. – Ayrx Nov 25 '12 at 5:33
  • Would it increase security to use a different port for the web servers? I don't see it being too much work to add :8080 or whatever to every link. I guess not really because it's still an open port but at least an attacker would have to check all ports and not assume port 80 is open. – Celeritas Nov 25 '12 at 5:38
  • @Celeritas It might, but it probably won't. My first reaction to a site that needs me to type ":8080" at the end of the link would be to never visit it ever again. Plus it won't stop anyone who is doing a comprehensive port scan of your network from finding which port your HTTP server is running on. – Ayrx Nov 25 '12 at 5:47
  • Why would you not visit it again? – Celeritas Nov 25 '12 at 5:52
  • 1
    Placing a site on a non-standard port number is essentially 'security through obscurity.' You are counting on others not knowing that your site exists as a means of protection. – Andrés Nava - .NET Nov 26 '12 at 23:23
0

It doesn't matter which port is open. An attacker would do a port scan and by then he would have known which services are running on which port. And if he sees some services that are easily exploitable, then obviously he would want to exploit it, be it port 80 or some random port.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.