27

I am running a small website using nginx. Since there's (probably) not going to be a lot of traffic in my server's lifespan and to avoid random DoS attacks, I am considering setting the web server to listen on an alternate port instead of port 80.

Does listening on an alternate port (81, 8080, etc.) actually reduce my risk of attacks or breaches? Or does the burden of maintaining it outweigh the benefits? In that case, should I be using those alternate ports for other web services in case I set them up in the future?

Improve this question
2

5 Answers 5

Reset to default
51

There are two things to consider here:

  1. Will your users remember to use a non-standard port in the name? By default, port 80 is the standard and therefore you do not have to type it into the URL. For example, http://superuser.com runs on port 80 and your browser assumes 80 is the port you mean when typing it in. It is no different than typing http://superuser.com:80. If you run your websever on port 8080, then the user has to type http://superuser.com:8080. The average user will not likely remember that.
  2. Does running a webserver on a non-standard port protect you from DoS attacks? Not really. If someone really wanted to bring your site down, running on a non standard port will not stop them. Attackers will scan all the ports on your IP and quickly find that 8080 (or whatever you choose) is open and responding to HTTP requests.

Methods like changing ports is called "Security through obscurity" and it is highly questionable that the extra work and inconvenience provides any valuable security.

Improve this answer
6
  • 7
    I want to add that not all Security through Obscurity is bad. Changing the default Administrator or Root username is considered a good practice. However, things like changing ports is pointless as there are only 32k and a computer can scan that in seconds.
    – Keltari
    Feb 23, 2014 at 19:23
  • 3
    It doesn't add security, but it does prevent crude scanning bots from slowing down your site, particularly if the site has a DNS record.
    – Nathan
    Jun 10, 2015 at 9:36
  • 1
    It totally depends on the scale of the attack. Using non-default ports may help evade large scale scans say of /0 for web server vulnerabilities using zmap or nmap. But @Keltari is correct, if you are a target, an attacker will perform a full scan on you, determine which port your server is running from and then game over, if you are vulnerable ;-).
    – wi1
    Jul 10, 2015 at 18:26
  • @NathanMacInnes with the technology available today, I'd assume that the # of bots that scan a small site is negligible, and the downside of changing a default port is pretty big.
    – ILikeTacos
    Aug 17, 2015 at 2:50
  • 3
    Wrong, it's https://superuser.com, and it runs on port 443. Secure websites use 443.
    – Elliot A.
    Feb 14, 2016 at 17:10
6

Yes, setting an alternate port actually reduce the risks of attacks, as the bots crawling the web to find flawed webapp usually doesn't look at other ports.

If a human attacker is aiming your server, it will be really easy to discover the real port on which nginx is listening on (by scanning open ports).

Using theses alternate ports is rare (except proxies or... alternate webservers) so I think you can use it without fear.

But remember that using such an alternate port will prevent "default" visitors to find your website, you will need to tell people (or write it in links) the right port by using URLs like http://yourserver.com:81/...

Improve this answer
2

An additional consideration (to the two provided by Keltari) is that using a non-standard port may result in your website being overlooked by search engine web crawlers like Google's, unless you specify otherwise.

If it is your intention that your website be difficult to find for everyone except the people you provide a link to, then using a non-standard port would seem to be favourable, but otherwise I'd go with a standard port.

Improve this answer
2

It depends. What's the use for the "small site"?

  • If it's going to be used by other people, I would highly recommend using standard ports. As mentioned in most of the answers, using a nonstandard port requires that the port is specified by the user (e.g. for port 81 -> yoursite.com:81). If you use a standard port, the browser infers the port from the protocol (http, https). http:// is normally port 80 and https:// is normally port 443, unless overridden. I highly recommend using standard ports. Sure, you CAN put the only entrance to a house in the backyard, but how will visitors know it's there?

  • If it's a testing site only used by you, there are two things to ask yourself:

    • Will it be attached to a DNS record (domain name)? (I find my servers with no DNS references are much quieter attack-wise. NOTE: please don't consider this as more secure. It's not; it just makes it more difficult for attackers to find you through DNS)
    • Are you OK with manually typing the port and/or IP?

TL;DR:

  • Used by other people: use 80/443
  • Private: Up to you
Improve this answer
0

You can run http server on any port , but it will be difficult for your surfers , users to remember the port .

It will reduce the risk of attacks or breaches, but there are other ways too, like securing your server and keep HTTP server on port 80

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .