-4

If I have a linux server with a FW rule (iptables) to allow inbound to a particular port does a service have to be running and listening to accept that connection or is there another way to access the system using that port? Perhaps a security vulnerability that can exploit that port without a service listening on it for connections? This question popped in my head when I noticed that I could not telnet to any port unless a service was actually listening on it, even if I had a FW rule in place for it.

3 Answers 3

1

Purely teoretically yes. But it means that there must be HUGE error in kernel to accept and use packets on every port and there is no way how this can be populated in kernel upstream. So answer to your question is no, port with no service is closed and safe. But best practice in firewall setting is to allow only specified list of ports and disable all others.

Of course, if someone compromise your server thru running service, he/she can start new service which will listen on new port.

2
  • Thanks. That's kinda what I thought as well. I am also struggling with the reasoning behind even running iptables. Why drop or reject packets that can't get through anyway if there is no corresponding service to answer? At least when you are talking about port blocking anyway. Maybe having iptables perform some other feature could be helpful.
    – user53029
    Nov 3, 2015 at 19:06
  • 1
    if you have drop or reject rule in iptables, packets which match this rule are "destroyed" before it can reach any service, running or not. Iptables rules are in front of any service and iptables don't know if there is anything listenning on that port. It is simple - admin don't want this packets in his/het system, so firewall will block it. Nov 3, 2015 at 19:10
1

you are lacking of basic system notions my friend. If the service, say sshd, is not running, how would you expect the system to open a socket on port 22?

When you run a service on your system, whatever port that service is using, the service notifies system to open a socket on that port for that service and then you'll see that system is listening on that port because its been told to do that. Without telling the system what to do I wonder how the system will provide connection to any inbound service.

Your question makes no sense at all.

2
  • So you are claiming that even on a compromised system an attacker could not start services which then open the ports?
    – user53029
    Nov 3, 2015 at 18:15
  • 1
    That would be a daft claim; if someone compromises your system they can do anything. But that's not what you asked, you asked if they could compromise your system through a closed port in the first place. Nov 3, 2015 at 18:24
1

No. You cannot access a port that has no service associated with it.

Not the answer you're looking for? Browse other questions tagged .