-: Unnecessary ports.
As we've already discussed, there are a lot of ports
available for use by your computers and your networks.
We started out with 65,536 ports available
back in our ports and protocol lesson.
Then, we narrowed it down to 35 ports
that you just had to memorize in the last lesson.
But does that mean that all 35 of those
are necessary for your computer to function?
Well, the answer is no.
When it comes down to it,
you aren't using all of those services,
at least not all of the time.
Also, if you're running a server,
you wouldn't want to have all 35 of those ports open either.
Why?
Because many of them are unnecessary.
Now, that begs the question, what makes a port unnecessary?
Well, an unnecessary port is simply one
that's associated with a service or a function
that you don't need or is considered non-essential.
For example, if you have a server whose entire
function is to act as a mail relay server,
all it's designed to do is send mail out,
then the only thing it needs is a couple of ports open.
It needs port 25 for SMTP and port 465
or 587 for SMTP over SSL and TLS.
Now, every other port on that server
can be shut or disabled or closed and you wouldn't care,
because only those three ports are the ones you need.
Remember, every open port represents
an unnecessary vulnerability being left exposed
if you didn't need to have that port open.
So, you want to close anything you're not using.
Because of this, security professionals
and analysts routinely scan their servers,
their routers, and their firewalls to ensure
that they understand exactly what ports
are open in their networks and which ones
they can disable or close.
For example, this is a result from one of my scans
and you can see there's three hosts
that have ports 139 and 445 open in the network.
Now, thinking back to our last lesson
where you memorized all the ports,
can you guess which services these
machines might be running?
Well, port 139 is used for net bios
and port 445 is used for SMB.
This means these three machines are most likely
running the Windows operating system
and they have file sharing enabled over the local network.
Now, if these machines don't need to have file
sharing enabled over the local network,
we can disable these ports and remove
the possible vulnerabilities that are inherent
within the Windows file-sharing system.
To close an unnecessary port,
there are three methods you can use.
First, you can stop the service that uses that port
from the operating system's graphical user interface.
To do that in Windows, simply open up
the computer management console,
select Services and Applications,
and then select Services.
From here, you double-click on
the particular service that you want to turn off,
and it's going to open up a dialog box as shown here.
Now, in this example, I've stopped
the Windows update service in Windows 10 from running,
which will also prevent any associated open ports
from remaining open because of this service running.
The second method is to do this
from the command line interface.
As I showed you back in our
operating system hardening lessons,
you can turn off a service by using
the net stop command and the name of the service.
On a Linux server, you can do this
by entering sudo stop and the name of the service
at the command line.
Now, the third way to do this
is to block the ports at your firewall,
whether this is a software or hardware-based firewall,
or on the server itself.
Now, usually, a firewall is going to block ports by default,
and it requires you to open the port
when you want to install a particular service or function.
Now, for example, let's say you installed
the Apache web server at one point,
and this opened up port 80 on your firewall.
Now, if you're no longer running that web server,
you need to go back on that firewall
and close or disable that port
by blocking it in the firewall rules.