A few friends are into “hacking” — I imagine many dream of becoming hackers — but they aren’t hackers; they just downloaded some tool software and scan all day. A friend asked me why my server only has ports 80 and 443 open. Don’t others need to open port 21 for FTP and such? And I don’t use any website guard, exposing my real IP directly. So let me share my thinking. [caption id="" align=“aligncenter” width=“1000”]
Keep server ports to a minimum[/caption] What is a server port? It’s like a series of doors. Why can one server be both a WEB server and an FTP server and provide other services? It’s distinguished by ports; different protocols use different ports. So what should our attitude toward ports be? I think we should open only the ports we use, and open as few as possible — fewer doors coming in means fewer places to defend. Conversely, the more ports open, the more attack methods we must defend against, and the more dangerous it is. A friend asked, if I don’t even open FTP’s port 21, how do I upload files? This is easy to solve — we can use email or network hard drives. Upload to email or network hard drive on your own computer, then go to the server and use the browser to download to the server. If you’re too lazy for that, you can install QQ on the server, log in, and send files over. As for port 443 — you may be less familiar with it. Port 443 is the HTTPS port; its function is actually the same as port 80, because I need to access the admin backend via HTTPS securely, and it requires verifying a client certificate to access. Direct access errors out: 403.4 Forbidden — you must use SSL to view this resource. So I must open port 443; otherwise I’d only open port 80, because my server only provides WEB services externally, and port 80 is enough.
