Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two dedicated servers. One which stores all the files (scripting) and the other hosts just the db.

In order to connect to the other server I have enabled port 2335 on TCP/IP and added the same to the firewall (excluded).

Now I am wondering if my server is vulnerable to hackers.

I'm using MS Server 2008 and MS Sql Server 2008.

Can you tell me how others might misuse this port.

share|improve this question

migrated from stackoverflow.com Jun 17 '11 at 11:18

This question came from our site for professional and enthusiast programmers.

    
using the same for Web hosting.. –  suraj jain Jun 17 '11 at 11:17

5 Answers 5

I'd suggest locking the firewall rules down to the specific IP addresses of the servers. so only they are allowed to communicate over the open port.

share|improve this answer
    
Thanks Matt..Have just enabled the scope of the rule.. allowing particular set of remote IP which can access the PORT.. –  suraj jain Jun 17 '11 at 12:31
    
Systems across the remote IPs need to be secure and functioning correctly as well, otherwise you're just calling out your potential attackers. –  user48838 Jun 17 '11 at 23:01

What would be of interest is:

  • what is running on those ports
  • can comms be initiated either way, or is one always the master

Locking down by IP will help reduce the risk, but if the service is critical and you must strongly authenticate the two servers to each other you could also look at setting up an SSL/TLS tunnel between the two machines, authenticated by a certificate.

share|improve this answer

It comes down to the application/system answering at the port. Is it secure with strong passwords and properly running code (e.g. no buffer overflows, back doors, etc.)? Does it function 100% as expected and then is it setup as well as run/maintained correctly?

share|improve this answer

Any server that is connected to the internet is potentially vunerable no matter how well you configured it and secured it (IP's can be spoofed so filtering on IP is not fool proof). The best security is to not connect a machine to the internet. Use a seperate internal network for communication between machines.

When you setup a secure VPN tunnel to this internal network you can also connect management interfaces (like IPMI, raid-controller, vSphere) to it so these won't need public IP addresses. It is much easier to work with one heavily secured VPN that gives you access to a relative save internal network then to have to heavily secure every single service on every machine.

share|improve this answer

Yes, having a MS SQL server exposed to the Internet at large is probably an unnecessary risk.

I concur with Matt's answer. Add a simple source IP address check and you will greatly reduce the risk.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.