Limit Open Ports to Reduce Attack Surface

Each open port on a server represents a potential entry point for attackers. If unnecessary ports are left open, they can be scanned, exploited, or used for unauthorized access. By limiting open ports to only essential services, you reduce the attack surface and increase overall security.

Check Open Ports on Your System

Use the following commands to list all open ports and active services:

✅ Using ss (Recommended for modern Linux systems):

sudo ss -tuln

✅ Using netstat (Older alternative):

sudo netstat -tulnp

✅ Using lsof to check which services are using ports:

sudo lsof -i -P -n

• -tuln → Lists TCP/UDP ports in listening mode, without resolving names.

• Look for unexpected open ports that do not belong to required services.

1. Disable and Stop Unnecessary Services

✅ Identify running services:

sudo systemctl list-units --type=service --state=running

✅ Stop an unnecessary service immediately:

sudo systemctl stop service_name

✅ Disable a service to prevent it from starting at boot:

sudo systemctl disable service_name

(Example: If FTP (vsftpd) is running but not needed, disable it)

sudo systemctl stop vsftpd
sudo systemctl disable vsftpd

2. Restrict Open Ports Using a Firewall (UFW or iptables)

✅ Using UFW (Uncomplicated Firewall - Ubuntu/Debian)

1. Allow only essential ports (SSH, HTTP, HTTPS):

   sudo ufw allow 22
   sudo ufw allow 80
   sudo ufw allow 443

2. Deny all other connections by default:

   sudo ufw default deny incoming

3. Enable the firewall:

   sudo ufw enable

4. Verify firewall rules:

   sudo ufw status

✅ Using iptables (For Advanced Users)

1. Allow SSH, HTTP, and HTTPS only:

   sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
   sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
   sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
   sudo iptables -A INPUT -j DROP

2. Save iptables rules permanently:

   sudo iptables-save | sudo tee /etc/iptables.rules

3. Monitor and Audit Open Ports Regularly

✅ Run periodic port scans using nmap from another machine:

sudo nmap -sS -p- server_ip

(Scans all open ports on the server to detect unexpected services.)

✅ Check listening services after updates or software installations:

sudo ss -tuln

✅ Review logs to identify unauthorized access attempts:

sudo cat /var/log/auth.log | grep "Failed"

Best Practices for Port Management

🔹 Apply the Principle of Least Privilege (PoLP): Only expose essential ports.
🔹 Use firewalls (UFW, iptables, or Firewalld) to enforce strict port rules.
🔹 Monitor logs and perform regular security scans to detect unauthorized access.
🔹 Use port knocking to further protect SSH access (see Port Knocking section).

By limiting open ports and closing unnecessary services, you reduce security risks and protect your Linux server from potential intrusions.