Why close ports and patch software?
Closing ports means stopping or blocking every program that a server does not need listening on the network. Patching means installing the updates that fix known flaws. Together they shrink what an attacker can reach and try.
A developer opened a port to test a new page, then went on holiday. The port stayed open for three months, and the program behind it was never updated. A port that nobody needs is a door that nobody watches.
By the end of this lesson
Note
I can find what a server listens on, close what it does not need and check for updates.
Key words
| Word | What it means | Example |
|---|---|---|
| Port | a numbered door on a machine that one program listens at | 22 |
| Listening | waiting at a port for somebody to connect | |
| Loopback | the address 127.0.0.1, which only the same machine can reach | |
| Default deny | refusing everything that no rule allows | |
| Patch | an update that fixes a known flaw | |
| Attack surface | everything an attacker can reach and try |
The cells students fill in are left blank in this preview.
What listens is what can be attacked
Each program that listens at a port is a way in. The fewer there are, the less an attacker can try.
The first job is to look. You will start two small web servers of your own from an empty folder, one open to the network and one only to this machine.
List what listens now
ss -ltnShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Make an empty folder to serve
mkdir -p empty-siteShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Start a network-open server on 8088
(timeout 120 python3 -m http.server 8088 --bind 0.0.0.0 --directory empty-site >/dev/null 2>&1 &)Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Start a loopback-only server on 8089
(timeout 120 python3 -m http.server 8089 --bind 127.0.0.1 --directory empty-site >/dev/null 2>&1 &)Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Compare the two
ss -ltn | grep -E ':808[89]'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Reading the Local Address column
The last Run printed two lines. One has 0.0.0.0:8088 and the other 127.0.0.1:8089.
The address 0.0.0.0 means every network the machine is on. The address 127.0.0.1 means this machine alone. The second server cannot be attacked from outside, and it needs no firewall rule.
Both servers stop by themselves after two minutes.
A rule can refuse a port
Sometimes a program must listen widely but should not be reached. A firewall rule on the machine can refuse it.
You now add one rule for port 8088 only, in a table of your own called practice. Your terminal is not touched, and nothing is saved. If a Run says nft: command not found, install it with sudo apt-get install -y nftables.
Refuse port 8088 with one rule
sudo nft 'add table inet practice; add chain inet practice guard { type filter hook input priority 0 ; policy accept ; }; add rule inet practice guard tcp dport 8088 reject with tcp reset'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask port 8088 now
curl -sS -m 3 http://127.0.0.1:8088/ 2>&1 | head -n 1Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask port 8089, which no rule touches
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8089/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the two answers say
The first curl printed curl: (7) Failed to connect to 127.0.0.1 port 8088, followed by a note about the time. The rule refused the connection at once. The second printed 200, so port 8089 still answers.
A real firewall starts the other way round. Its policy is default deny, and one rule allows each port that is needed.
Worked example: default deny for a web server
| Port | Used for | Rule |
|---|---|---|
| 22 | SSH for the administrator | Allow, from the office address only |
| 443 | The website | Allow, from everywhere |
| 8088 | A forgotten test page | No rule, so it is refused |
The cells students fill in are left blank in this preview.
Delete the practice table
sudo nft delete table inet practiceShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Stop both throwaway servers
pkill -f 'http.server 808'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Patches close flaws other people found
Most attacks use a flaw that already has a fix. A server that is behind on updates is easy to attack.
You can look without changing anything. The option -s means simulate: it prints what it would do and does nothing. Counts depend on the day, so nothing here gives a number.
Is a newer version of openssl on offer?
apt-cache policy openssl | head -n 3Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
How many updates would an upgrade install?
sudo apt-get -s upgrade | grep -c '^Inst'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think a port is safe because nobody knows it is there. Scanners try every port in minutes. A port is safe when no program listens at it, or when a rule refuses it. Being unknown is not a control.
Going further: patch on a schedule
Run ls /etc/apt/apt.conf.d and look for a file with auto-upgrades in its name. If it is there, read it with cat. It says whether the machine installs security updates by itself.
Write two sentences: one reason to let a server update itself, and one reason a college might want to test updates first.