Common Ports and Protocols
The shop's web server runs several services at once: the website, secure remote administration and email. They share one IP address, so how does incoming traffic find the right one? By port number. Every open port is a service waiting for anyone who knocks.
The rule
An open port is an open door. Close every door you don't use.
If the IP address is the building, the port is the door number. A service listens on a port; anything that is allowed to reach that port can talk to it. Common ones to know:
| Port | Protocol | Used for | Encrypted? |
|---|---|---|---|
| 20, 21 | FTP | Transferring files | No |
| 22 | SSH / SFTP | Remote admin, secure file transfer | Yes |
| 23 | Telnet | Old remote admin | No |
| 25 | SMTP | Sending email between servers | Optional |
| 53 | DNS | Name lookups | Usually no |
| 80 | HTTP | Websites | No |
| 443 | HTTPS | Websites | Yes |
| 3389 | RDP | Windows remote desktop | Yes, but a frequent target |
Two rules fall out of the table:
- Prefer the encrypted partner. SSH instead of Telnet, SFTP instead of FTP, HTTPS instead of HTTP. The unencrypted ones send passwords as readable text.
- Expose the minimum. Remote-access ports like 22 and 3389 should not be open to the whole internet if you can avoid it; limit them to known addresses or put them behind a VPN.
The shortcut
For each open port, ask two questions: "Do we use it?" and "Is there an encrypted version?" Not used: close it. Unencrypted: switch to the partner.
List what is open
21 (FTP), 22 (SSH), 80 (HTTP), 443 (HTTPS), 3389 (RDP).
Port 80 is kept open only to redirect people who type the address without https. It serves no content itself.
Drills
Answer fast — trust the rule.
Which port does HTTPS use by default?
Which is the secure replacement for Telnet?
The shop no longer uses a service listening on port 3389. What should you do?
Why is FTP a poor choice for uploading files to the web server?
Remember
- An open port is an open door. Close every door you don't use.
- For each port: "Do we use it?" and "Is there an encrypted version?"
- Trap: leaving remote-access ports such as 22 and 3389 open to the whole internet.