What's the real danger of opening ports?

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨dontblink@feddit.it⁩ to ⁨selfhosted@lemmy.world⁩

Some services run really good behind a reverse proxy on 443, but some others can really become an hassle… And sometimes just opening other ports would be easier than to try configuring everything to work through 443.

An example that comes to my mind is SSH, yeah you can use SSLH to forward requests coming from 443 to 22, but it’s so much easier to just leave 22 open…

Now, for SSH, if you have certificate authentication or a strong password, I think you can feel quite safe, but what about other random ports? What risks I’m exposing my server to if I open some of them when needed for a service? Is the effort of trying to pass everything through 443/80 worth it?

source

Comments

Sort:hotnew top

ryokimball@infosec.pub ⁨3⁩ ⁨weeks⁩ ago
If you are trying to access several different services through the internet to your home network, you are better off setting up a home VPN then trying to manage multiple public facing services. The more you publish directly to the public, the more difficult it is to keep up with everything; It is likely needlessly expanding your threat exposure. Plus you never know when a new exploit gets published against any of the services you have available.

source
- 0x0@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  
  setting up a home VPN then trying to manage multiple public facing services.
  
  You mean than? Not being anal it but does change the meaning.
  
  source
  - ryokimball@infosec.pub ⁨3⁩ ⁨weeks⁩ ago
    You’re correct, imma let voice-to-text take the blame there.
    
    source
- Dagnet@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  Self hosted newbie here. What if those services are docker containers? Wouldn’t the threat be isolated from the rest of the machine?
  
  source
  - Technus@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
    No. Docker containers aren’t a full sandbox. There’s a number of exploits that can break out of a container and gain root access to the host.
    
    source
    -> View More Comments
  - non_burglar@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
    Is your container isolated from your internal network?
    
    If I were to compromise your container, I’d immediately pivot to other systems on your private network.
    
    Why do the difficult thing of breaking out of a container when there’s a good chance I can use the credentials I got breaking in to your container to access other systems on your network?
    
    source
  - oddlyqueer@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago
    it’s an extra hurdle, but it’s far from a guaranteed barrier. There’s a whole class of exploits called container escapes (or hypervisor escapes if you’re dealing with old-school VMs) that specifically focus on escalating an attack from a compromised container into whatever machine is hosting the container.
    
    source
  - Onomatopoeia@lemmy.cafe ⁨3⁩ ⁨weeks⁩ ago
    Others have clarified, but I’d like to add that security isn’t one thing - it’s done in layers so each layer protects from potential failures in another layer.
    
    This is called The Swiss Cheese Model. of risk mitigation.
    
    If you take a bunch of random slices of Swiss cheese and stack them up, how likely is there to be a single hole that goes though every layer?
    
    Using more layers reduces the risk of “hole alignment”.
    
    Here’s an example model:
    
    So a router that has no open ports, then a mesh VPN (wireguard/Tailscale) to access different services.
    
    That VPN should have rules that only specific ports may be connected to specific hosts.
    
    Hosts are on an isolated network (could be VLANS), with only specific ports permitted into the VLAN via the VPN (service dependent).
    
    Each service and host should use unique names for admin/root, with complex passwords, and preferably 2FA (or in the case of SSH, certs).
    
    Admin/root access should be limited to local devices, and if you want to get really restrictive, specific devices.
    
    In the Enterprise it’s not unusual to have an admin password management system that you have to request an admin password for a specific system, for a specific period of time (which is delivered via a secure mechanism, sometimes in person). This is logged, and when the requested time frame expires the password is changed.
    
    Everyone’s risk model and Swiss cheese layering will fall somewhere on this scale.
    
    source
skankhunt42@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago
It’s not so much about the ports, its about what you’re running that’s accessible to the public.

If you have a single website on 443 and SSH on 22 (or a non-standard port like 6543) you’re generally considered safe. This is 2 services and someone would need to attack one of the two to get in.

If you have a VPN on 4567 and everything behind the VPN then someone would need to hack the VPN to get in.

If you have 100 different things behind 443 then someone just needs to find a hole in one to get in.

Generally ssh, nginx, a VPN are all safe and they should be on their own ports.

source
- sfjvvssss@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  Sorry to nitpick but I feel like beimg precise here is important. Nginx is a project, ssh a protocol and VPN an overlay network, so more of a concept. All 3 can be run somewhere on the spectrum between quite secure and super insecure. Also safe and secure are two different things, I guess you meant secure so no big deal.
  
  source
- rumba@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  Everything you expose is fine until somebody finds a zero day.
  
  Everything these days is being built from a ton of publically maintained packages. All it takes is for one of those packages to fall into the wrong hands and get updated which happens all the time.
  
  If you’re going to expose web yourself, use anubus and fail2ban
  
  Put everything that doesn’t absolutely need to be public open behind a VPN.
  
  Keep all of your software updated, constant vigilance.
  
  source
Sanctus@anarchist.nexus ⁨3⁩ ⁨weeks⁩ ago
It just widens your attack surface for the ghost army of bots that roam the net knocking on ports, you don’t want to be someone else’s sap. I would imagine most home attacks fall into three categories: script kiddies just war driving, targeted attacks on someone specific, or just plain ol’ looking for sensitive docs for identity theft or something. Its still the net, man. If you leave your ass hanging out someone’s gonna bite it in a new way every time.

source
lorentz@feddit.it ⁨3⁩ ⁨weeks⁩ ago
It is not just a matter of how many ports are open. It is about the attack surface. You can have a single 443 open with the best reverse proxy, but if you have a crappy app behind which allows remote code execution you are fucked no matter what.

Each port open exposes one or more services on internet. You have to decide how much you trust each of these services to be secure and how much you trust your password.

While we can agree that SSH is a very safe service, if you allow password login for root and the password is “root” the first scanner that passes will get control of your server.

As other mentioned, having everything behind a vpn is the best way to reduce the attack surface: vpn software is usually written with safety in mind so you reduce the risk of zero days attacks. Also many vpn use certificates to authenticate the user, making guessing access virtually impossible.

source
possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
With SSH it is easier to do key authentication. Certificate authentication is supported but it is a little more hassle. Don’t use password authentication as it is deprecated and not secure.

The key with SSH (openssh specifically) is that it is heavily audited so it is unlikely to have any issues. The problem is when you start exposing self hosted services with lots of attack surface. You need to be very careful when exposing services as web services are very hard to secure and can be the source of a compromise that you may or may not be aware of.

It is much safer to use a overlay VPN or some other frontend for authentication like mTLS or an authenticated reverse proxy.

source
- cmnybo@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
  Be sure to keep everything up to date too. Even openssh has had multiple vulnerabilities just this year.
  
  source
  - possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
    Always good advise
    
    source
    -> View More Comments
sadfitzy@ttrpg.network ⁨3⁩ ⁨weeks⁩ ago
Opening ports essentially allows other computers on the internet to initiate a connection with yours.

It’s only dangerous if a service running on those ports can be exploited.

source
- roofuskit@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  “If” is not the correct word choice. It’s only dangerous when a service on the port gets exploited.
  
  source
  - metaStatic@kbin.earth ⁨3⁩ ⁨weeks⁩ ago
    Driving a car is only dangerous when you die in a traffic accident.
    
    your logic doesn't check out.
    
    source
    -> View More Comments
- ganymede@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  to reduce attack-surface, if there’s no reason for the port to be open, don’t open it.
  
  source
- medem@lemmy.wtf ⁨3⁩ ⁨weeks⁩ ago
  This, coupled with the fact that firewalls are protocol-agnostic. You can, for instance, use ‘port https’ in your Packet Filter config instead of ‘port 443’, but that simply means that PF will block/pass traffic to whatever service is bound to that particular port, and NOT https connections in general.
  
  source
bigfondue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
If you can disable IPv4 on sshd then it really isn’t an issue. I know, security through obscurity isn’t robust, but when I had sshd with IPv4 enabled, I was getting around 6 - 10 failed login attempts a minute. People iterate through all the possible IPv4 addresses since there are only 4,228,250,625 possible addresses. There are 340,282,366,920,938,463,463,374,607,431,768,211,456 possible IPv6 addresses, so the chance of someone randomly stumbling upon your address is fucking astronomical. When I disabled IPv4 a couple years ago I’ve had exactly zero failed logins that weren’t me being a sloppy typist.

source
- ganymede@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  
  People iterate through all the IPv4 addresses since there are only 4,294,967,296 possible addresses. There are 340,282,366,920,938,463,463,374,607,431,768,211,456 possible IPv6 addresses
  
  i love your thinking!!
  
  do you have a backup in case you accidentally find yourself locked out from an ipv4-only network?
  
  source
  - bigfondue@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Not really. My home network doesn’t have any port forwarding so nothing is exposed. I have a VPS, but nothing really important is on there, and I pretty much exclusively use it from home. Anyway all those failed logins were just trying default logins like user admin password admin. If you have a strong password or ssh key it really doesn’t matter, but I just hated knowing people were trying to get in, even if it was just half-assed attempts to find a unsecured machine.
    
    source
01189998819991197253@infosec.pub ⁨3⁩ ⁨weeks⁩ ago
Imagine opening all the windows in your flat. Then leaving them open for a month. What would happen? How many insects would make their new home in your home? How many critters and cats would do the same?

Now, each window is a port. Your flat is your network. Each critter or cat is a bad actor. Each insect is a bot or virus.

source
- possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  To expand on this a bit:
  
  A lot of attacks are automated since the goal is to compromise as many hosts as possible. These hosts are then used in a botnet or sold to people on shader websites to use as proxies.
  
  source
- atzanteol@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
  This is an awful analogy…
  
  source
Smokeydope@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Less danger than OPsec nerds hype up but enough of a concern you want at least a reverse proxy. The new FOSS replacement for cloudflare on the block is Anubis github.com/TecharoHQ/anubis, while Im not the biggest fan of seeing chibi anime funkopop girl thing wag its finger at me for a second or two as it test connection, I cannot deny the results seem effective enough that all the cool kids on the FOSS circle all are switching to it over cloudflare.

source
Onomatopoeia@lemmy.cafe ⁨3⁩ ⁨weeks⁩ ago
About 5 years ago I opened a port to run a test.

Within hours it was getting hammered (probably by scripts) trying to figure out what that port was forwarded to, and trying to connect.

I closed the port about a week later, but not before that poor consumer router was overwhelmed with the hits.

I closed the port after a week. For the next 2 years I’d get hammered with scans occasionally.

There are tools out there continually looking for open ports, they probably get added to a database and hackers/script kiddies, whoever, will try to get in.

Whats interesting is I did the same thing around 2000 with a DSL connection (which was very much a static address) and it wasn’t an issue even though there were fewer always-on consume connections.

source
tvcvt@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago
There’s definitely nothing magic about ports 443 and 80. The risk is always that the underlying service will provide a vulnerability through which attackers could find a way. Any port presents an opportunity for attack; the security of the service is the is what makes it safe or not.

I’d argue that long tested services like ssh, absent misconfiguration, are at least as safe as most reverse proxies. That doesn’t mean to say that people won’t try to break in via port 22. They sure will—they try on web ports too.

source
abs_mess@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago
Not a sysadmin, just a casual IT.

If it is open, it is going to get hit by scanners, scrapers, everything and the sun, even if it is secure. Generally, 443 for your websites via reverse proxy with an IP whitelist + password is okay. Not special, lets you add subdomains, very convenient.

Now, there isn’t anything special about any given port, but you still need to have some form of access control that you need to set up. If it is an API have some sort of API key in place. Implement 2FA. Try to isolate the service from the machine. Isolate the machine from bare metal. Keep the bare metal machine isolated from your home network. Take up farming. Change the default port and add some form of access alerts/logs. Have some sort of fail2ban service in place because you will be firehosed with scripts and bad traffic.

Maybe some of the stuff I recommend is paranoid overkill, but I don’t know enough to cut corners. Security is a hassle, a breach is a nightmare.

source
- possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  IP whitelists are not terribly secure and are quite a hassle.
  
  Instead use a overlay VPN or some sort of extra security layer like mTLS or Authelia
  
  source
  - 0x0@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
    
    Authelia
    
    Seems interesting…
    
    source
non_burglar@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
Presuming you have not limited edge port 22 to one or two IPS and that you are not translating a high port to 22 internal, the danger is that you are allowing the entire internet to hammer away at your ssh. If you have this described setup, you will most definitely see the evidence of attempts to break in in your SSH endpoint and firewall logs.

Zero days for SSH do exist, so it’s just a matter of time before you’re compromised if you leave this open.

source
- possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  This is security theater
  
  source
  - non_burglar@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
    My comment was not a recommendation. OP asked what the danger is of leaving short open on port 22.
    
    source
blargh513@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
Get a WAF. Sophos firewall is free if you want to diy. If not, use cloudflare.

Opening ports, logging, monitoring, nailing up allow listed IP addresses and dicking around with fail2ban is such a timesuck. None of that crap will stop something from exploiting a vulnerability.

Some things are worth farming out to a 3rd party. Plus, you can just point your DNS entry over and be mostly done. No more dynamic IP bs.

source
- sfjvvssss@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  A WAF won’t magically solve your problems and free you from your attack surface. Your public facing services should be treated, configured and maintained as such. I am not sure if you include a WAF in the stuff that won’t stop exploitation of vulns, but it definitely belongs there. Yes, it can decrease volume and make exploitation a bit harder but that’s it usually. Also don’t just include proprietary third party stuff and hope it solves your problems.
  
  source
  - blargh513@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
    It isn’t a magic solution, no, but you have a lot more control than crummy layer 3 firewall rules and endless lists.
    
    The big players have far more data about what bad looks like. Either we can play whack a mole with outdated tools and techniques or get smart and learn to use what is available.
    
    Self hosting doesn’t mean we go backward in terms of the sophistication and difficulty, it means embracing modern solutions.
    
    In the dinosaur days, we had primitive tools, but so did the attackers. We cannot hope to self host with any measure of security if we bring piss to a shitfight.
    
    source
    -> View More Comments
vane@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
you can reverse proxy other ports than 443 and ex. upstream ssh, the advantage of having reverse proxy over everything is to have traffic in one place so you can manage it, that’s why for example kubernetes have ingress server, example nginx / openresty upstream ssh

stream { upstream ssh { server 127.0.0.1:22; } server { listen 2222; ssl_preread on; proxy_pass ssh; } }
source
- dontblink@feddit.it ⁨3⁩ ⁨weeks⁩ ago
  As far as I knew reverse proxies could only reverse proxy stuff coming in from 443 or 80, I didn’t know they could listen other ports as well!
  
  Main reason why I was using a reverse proxy at first is because I had everything behind cloudflare, and cloudflare can only proxy and give you an SSL encryption for stuff that goes through 443, so I could make Caddy listen to 443 and then forward to interested ports.
  
  But this leaves out everything that needs to go in some other places than 443, and requires its own standalone ssl certificate, which is a bit cumbersome. Pheraps these can be proxied with other proxies than cloudflare, hopefully giving SSL to everything…
  
  I’m not sure I understood the upstream ssh thing, what do you actually do?
  
  source
  - Lem453@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
    Traekif can reverse proxy just about anything include ssh.
    
    That being said I don’t. For stuff like ssh I connect with wireguard first then ssh. For stuff like immich I directly expose that behind traefik so I can share images with others. For stuff like vaultwarden I have that behind traefik but internal only so you need wireguard first then you connect to vaultwarden.local.domain.com
    
    source
  - vane@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
    this is nginx / openresty config - upstream is just definition of server / bunch of servers if you do loadbalancing or want to configure stuff you can do
    
    stream { upstream something { server xxx:123; server yyy:321; } server { listen 666; proxy_pass something; } }
    
    docs.nginx.com/nginx/…/tcp-udp-load-balancer/
    
    I use openresty with autossl, it renews certificates automatically. The only problem is maintaining subdomain allowance otherwise bots will ddos letsencrypt that would soft ban you to create certificates for new domains / subdomains.
    
    source
Itdidnttrickledown@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
Move the port to a high port. Install fail2ban and set it to ban quickly. The downside of that is if you fat finger your login more than a couple of times it might ban you. I have whitelist on mine of the IP addresses I know I will be logging in from. I also run TCP wrappers which far too many people screech about it being depreciated. it works and also if set up properly logs all login attempts. I get about three or four a month on my random high port. Of course most of this depends on you trying to gain access from known addresses or subnet.

I only have the ssh login as a backup. I run wireguard with the ports set to something other than the default port. It allows me to gain access to my home network quickly. While its always possible there might be some bug that would allow someone to access it in the future it works as well as any other solution.

source
0x0@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
Firewalls, containers, separate subnets (or VLANs if possible), VPNs.
Keep really public stuff in a VPS though, and the private in your home server. Connect them via wireguard (using e.g. headscale).

source
horse@feddit.org ⁨2⁩ ⁨weeks⁩ ago
Personally I don’t forward ports for anything that only I am supposed to access (such as SSH). Instead I connect to my home network via VPN and establish the connection from the inside. I just have an allow all from the VPN subnet to my main one, but you could also allow things selectively if you don’t want everything accessible via VPN. Using the VPN has the added bonus of ensuring everything is going through a secure tunnel if I’m connecting from a public network.

source
lka1988@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago
The only ports I have open are 80 and 443, and 80 just redirects to 443.

I also have a BeamMP server that has to have a port open because that’s just how it works, but that VM sits on its own DMZ’d VLAN and is only open when I’m actively playing the game.

source