Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am running a small website using nginx. Since there's (probably) not going to be a lot of traffic in my server's lifespan and to avoid random DoS attacks, I am considering setting the web server to listen on an alternate port instead of port 80.

Does listening on an alternate port (81, 8080, etc.) actually reduce my risk of attacks or breaches? Or does the burden of maintaining it outweigh the benefits? In that case, should I be using those alternate ports for other web services in case I set them up in the future?

share|improve this question
1  
Why some 'attackers' will takes risks to (D)DoS a small website ? –  sputnick Feb 23 at 18:03
add comment

4 Answers

up vote 12 down vote accepted

There are two things to consider here:

  1. Will your users remember to use a non-standard port in the name? By default, port 80 is the standard and therefore you do not have to type it into the URL. For example, http://superuser.com runs on port 80 and your browser assumes 80 is the port you mean when typing it in. It is no different than typing http://superuser.com:80. If you run your websever on port 8080, then the user has to type http://superuser.com:8080. The average user will not likely remember that.
  2. Does running a webserver on a non-standard port protect you from DoS attacks? Not really. If someone really wanted to bring your site down, running on a non standard port will not stop them. Attackers will scan all the ports on your IP and quickly find that 8080 (or whatever you choose) is open and responding to HTTP requests.

Methods like changing ports is called "Security through obscurity" and it is highly questionable that the extra work and inconvenience provides any valuable security.

share|improve this answer
3  
I want to add that not all Security through Obscurity is bad. Changing the default Administrator or Root username is considered a good practice. However, things like changing ports is pointless as there are only 32k and a computer can scan that in seconds. –  Keltari Feb 23 at 19:23
add comment

Yes, setting an alternate port actually reduce the risks of attacks, as the bots crawling the web to find flawed webapp usually doesn't look at other ports.

If a human attacker is aiming your server, it will be really easy to discover the real port on which nginx is listening on (by scanning open ports).

Using theses alternate ports is rare (except proxies or... alternate webservers) so I think you can use it without fear.

But remember that using such an alternate port will prevent "default" visitors to find your website, you will need to tell people (or write it in links) the right port by using URLs like http://yourserver.com:81/...

share|improve this answer
add comment

You can run http server on any port , but it will be difficult for your surfers , users to remember the port .

It will reduce the risk of attacks or breaches, but there are other ways too, like securing your server and keep HTTP server on port 80

share|improve this answer
add comment

An additional consideration (to the two provided by Keltari) is that using a non-standard port may result in your website being overlooked by search engine web crawlers like Google's, unless you specify otherwise.

If it is your intention that your website be difficult to find for everyone except the people you provide a link to, then using a non-standard port would seem to be favourable, but otherwise I'd go with a standard port.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.