Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have opened port 80 to traffic for some web page development I'm doing (using port forwarding in my router). I realize this opens up my computer to intruders. What's the best way to prevent intruders from coming in through port 80 while it's open? I'm working on a Mac.

Is there a Mac firewall setting or program that will detect and notify me of traffic (either unexpected traffic or all traffic) on this port? What I imagine is a dialog box would pop up for every access attempt, and I would have to approve it before it comes in.

share|improve this question

5 Answers 5

If you had a dialogue opened up for every time someone hit your IP on port 80, you'd have a never-ending flood of dialogue boxes. The real solution is to either require authentication on your site (.htaccess style) or alternatively, set up your firewall to only allow connections to port 80 from a pre-determined list of IP addresses.

share|improve this answer
    
Well answered.. +1 –  Arenstar Nov 14 '10 at 20:14

You could keep a terminal open and tail -F /var/log/apache2/access.log (or equivalent). You could also tail -F /var/auth.log | grep -i port 80 (or equivalent) in another window. Or you could use multitail to watch both files in the same window.

share|improve this answer

Is there a reason why you have port 80 open to your development machine in the first place? i.e. are you letting clients view the work in progress of the site off of your Mac?

Assuming that's the case, and that the work you're doing will end up on a Web server/hosting provider eventually, I'd recommend getting into the habit of setting up test sites (with or without authentication) on the Web server that will host the site eventually or a dedicated test or staging server.

This can be as simple as setting up another virtual host in Apache on a sub-domain such as dev.example.com or if you don't have control over their DNS, setting up client.yourdomain.com and having that on a separate virtual host somewhere.

The reason for doing this is a) you don't have to open up the world to your workstation b) you can leave it up 24/7 c) you won't have any "surprises" when promoting your changes live (like broken paths or absolute URLs that you forgot about) because you've already been doing this all along.

share|improve this answer
    
Thanks for the suggestion. I have port 80 open because my program makes requests to Facebook JavaScript API, and I understand I need to open port 80 to receive responses behind the firewall. –  Doug Kramer Nov 15 '10 at 6:25
1  
@Doug - if all you're doing is making outbound requests then you don't need any specific firewall rules other than port 80 outbound being open. –  EEAA Nov 15 '10 at 13:19

You could just use tcpdump/wireshark and watch eactly what is happening. Add the appropriate filters so you don't get flooded with more information then you need.

As ErikA mentioned though, it would be much better to just use the firewall rules or Apache config and limit access to the appropriate users.

share|improve this answer

You could also check out the app, Little Snitch. It's pretty great at catching all kinds of traffic, and let's you decide which bits you want to allow and deny. I think it's exactly the tool you are looking for.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.