Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, so, here is my my issue. awhile back, a friend wanted to grab some files from me, so I gave him my AFP (Apple File Protocol) address. Much like FTP SSH or SMB. Its cool for mac users and thats about it. He was really surprised that I was forwarding that port and warned me to close all ports, ssh, ftp, afp, smb, torrent... etc. Basiclily closing all ports to my house. He said that i should have only one port open and thats to VPN into behind my firewall and then I can access all of my protocols and more. I understand that this is more secure. But its really slow. Im a photographer and I may have to download files that are 20-30 GB. Without the VPN this took a long time. With VPN, it even takes longer.

So, is it really necessary to have all ports closed. I have very long sophisticated passwords that are combination of lips numbers digit caps and lowercase all mixed and not including a single dictionary word or acronyms.

Can I open up my AFP port? What are the odds/risks of a DDOS or even bruteforce attack?

share|improve this question

migrated from Feb 4 '11 at 20:43

This question came from our site for professional and enthusiast programmers.

Your second paragraph is unintentionally very funny. Check the spelling of sophisticated. – Jared Farrish Feb 4 '11 at 19:32
up vote 6 down vote accepted

The problem with a port open and exposed to the internet is that there is a program listening for messages on that port. If the messages that arrive are malformed (by the rules of the program doing the listening), then it should reject the request and close the port. However, if the program doing the listening has any vulnerabilities, then the attacker can perhaps craft messages that, instead of being rejected, are accepted as valid but which don't do what you wanted.

For example, your AFP port - what messages can be sent to it, and what can they do? Does it require a username and password to authenticate? If so, then you may be reasonably safe if all the user names and passwords that could be used are safe. If it does not require a username and password, or has simple bypasses for a guest user, or anything like that, then you allow outsiders onto your system and (independently of any bugs in the AFP programs) can do anything that the protocol allows. Do you know all the possible operations that can be requested over AFP? Really all of them, or just the documented ones? Are they all safe? Do you mind that someone can see your ... private data?

Clearly, if the AFP requires authentication and you're sure the authentication is safe regardless of what is chucked at it, so only someone who knows your user names and the corresponding passwords can break in, then you have made it harder for the putative attacker to get it - maybe, if you're lucky, they won't bother. But they may bother. If you don't need the port open permanently, don't leave it open; it reduces the chances that a malicious attack will succeed. (The securest software is the software that isn't installed; the next securest software is the software that can't be run.)

share|improve this answer
Good answer. In addition to security vulnerabilities, security configuration is also important. Even if AFP has zero vulnerabilities, if you configure it in an insecure way it may leave you open to an attack. The really popular server applications (sshd, apache, etc.) have been battle-tested for so long that most people assume that there are few known vulnerabilities and lots of documentation about how to configure securely; for lesser known protocols, that same collective peace of mind may not exist. – mehaase Mar 8 '11 at 22:36
Get a good firewall that will handle that for you. Manually editing your ports is prob. not the best option for almost all people, especially if you are unsure which should be open or closed. – Usta Jun 10 '12 at 0:51

I you can control which end you connect from you may be able to run a little faster. Outgoing connections from you Mac to a site not requiring the VPN may be faster than incoming connections over the VPN. Unfortunately, the VPN has some overhead which can slow transfers. If you are transferring compressed files, then it may be useful to turn off compression on the VPN connection.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .