Port Management & Security

Imagine a server as an apartment building. Each apartment has a number, and visitors need to know which apartment number to go to. In networking, these 'apartment numbers' are called ports.

Network ports are communication endpoints. They help your server direct incoming network traffic to the correct service or application. Each port is assigned a unique number, ranging from 0 to 65535.

Many services use standard, well-known port numbers. Knowing these helps you identify services and configure firewalls.

• Port 22: Used for SSH (Secure Shell) for remote access.
• Port 80: Used for HTTP (Hypertext Transfer Protocol) for standard web traffic.
• Port 443: Used for HTTPS (HTTP Secure) for encrypted web traffic.
• Port 53: Used for DNS (Domain Name System) name resolution.

These are just a few examples; thousands of ports exist for various applications.

Before you open new ports, it's good to know which ones are already active on your server. The ss command (socket statistics) is a modern tool to inspect network sockets.

The -ltn options show listening TCP sockets numerically without resolving hostnames.

UFW (Uncomplicated Firewall) is a popular firewall management tool on Ubuntu and other Debian-based systems. It simplifies configuring iptables rules.

To allow or deny traffic, you specify the port number and protocol (TCP or UDP). Remember to reload or enable UFW after changes.

On CentOS, RHEL, and Fedora systems, firewalld is the default firewall management utility. It uses 'zones' to manage different network interfaces.

You add rules to a zone, typically the public zone for internet-facing services, and then reload firewalld to apply changes.

Port forwarding is a technique that redirects network traffic from one port to another. This can be on the same machine, or from one machine to another.

It's often used to allow external devices to access services on a private network, or to tunnel traffic securely through an intermediary server.

One common type is Local Port Forwarding using SSH. This creates a secure tunnel from your local machine to a remote server, and then from that remote server to another target host and port (which could even be the remote server itself).

It's useful for accessing services on a remote private network that aren't directly exposed to the internet, like a database or an internal web application.

Here's how you can use SSH local port forwarding. This command forwards traffic from your local machine's port 8080 to port 80 on the localhost (the remote server itself) through the SSH connection to your_server_ip.

Once connected, you can access the remote web server (on port 80) by browsing to http://localhost:8080 on your local machine.

Managing ports is crucial for server security. Here are key practices:

• Principle of Least Privilege: Only open ports that are absolutely necessary for your services to function.
• Regular Audits: Periodically check your firewall rules and active listening ports to ensure no unauthorized ports are open.
• Strong Passwords/Keys: For services like SSH, always use strong authentication.
• Rate Limiting: Consider limiting connection attempts to critical ports (like SSH) to prevent brute-force attacks.

Which of the following are considered good security practices when managing server ports?

In this lesson, we explored network ports, which are essential for directing traffic to server services. We learned about common port numbers and how to check listening ports with ss.

You now know how to manage firewall rules using UFW and firewalld, and understand the concept of SSH local port forwarding. Crucially, we covered best practices for port security to keep your server safe.