Close the ports you do not use and open 22 only when needed

A server on the internet receives thousands of connection attempts a day. They are not hackers looking at you in particular: they are automated programs that sweep every address on the internet trying doors. If they find one open, they try passwords; if they find an old program, they try known flaws. Every open port you do not need is one more door for those programs, and closing it costs nothing.

Most of the machines Simplio sees have port 22 (the administration port) open to the whole world since the day they were created, because that is the default. It is like leaving the door of the utility room open onto the street. This guide shows you how to see which doors your machine has open, close the ones you do not need and open the administration one only from your office and only while you are using it.

Step by step

1. Decide which ports your machine really needs

   For a website, the list is short: 80 (HTTP, to redirect to HTTPS) and 443 (HTTPS). Nothing else. Everything other than that is for administration, and you administer it, not the world.

   Ports that should never be open to the whole internet:

   • 22 (SSH) and 3389 (Windows remote desktop): administration. Only to your IP, and better still only while you are using it.
   • 3306 (MySQL/MariaDB) and 5432 (PostgreSQL): the database. If the website is on the same machine, the port does not need to be open to the outside at all. If another machine connects to it, open it only to that machine's IP.
   • 21 (FTP): uploads files unencrypted. If you need to upload things, use SFTP, which goes through 22.
   • 10000 (Webmin), 8080 and 8443 (panels and test environments), 9090, 5000: administration panels that often have weak passwords or old versions.
   • 25 (outgoing mail): AWS restricts it by default and almost no website needs it open inbound.

   If there is a port in your firewall and you do not know what it is for, the right answer is to close it and see whether anything stops working. Usually, nothing does.

2. Review the firewall of a Lightsail machine

   Go to Lightsail, click the machine's name and open the Networking tab. Under IPv4 Firewall is the list of rules, each with application, protocol, port and the Restricted to column. If that column says "Any IPv4 address", that port is open to the world.

   What should remain:

   • HTTP, TCP, 80, any address.
   • HTTPS, TCP, 443, any address.
   • SSH, TCP, 22, restricted to your IP (step 4), or simply no rule at all when you are not using it.

   To delete a rule, click the bin icon on the right. To edit it, the pencil. Changes apply immediately, with no restart. If you have IPv6 enabled, repeat in the IPv6 Firewall block: it is a separate list and is often forgotten.

   Do this on every machine: the Lightsail firewall is per instance and is not shared.

3. Review the security groups of an EC2 machine

   Go to EC2, Instances, click the machine and open the Security tab. You will see the security groups assigned to it (there may be several; their rules add up) and below them the combined Inbound rules. Look at the Source column: 0.0.0.0/0 or ::/0 means open to the world.

   To change something, click the group's name, Inbound rules tab, Edit inbound rules button. Remove the ones you do not need with Delete and click Save rules. Leave the outbound rules as they are: by default they allow everything outbound and that is normal.

   Two things that happen a lot in EC2:

   • A group called launch-wizard-3 or similar, created on the fly when the machine was launched, with 22 open to everyone. That is the one to fix.
   • The same group assigned to the website and to the database. Then the database has 80 open and the website has 3306. Make one group per role: web with 80 and 443, bbdd with 3306 only from the web group (in Source you can type the identifier of another group instead of an IP).

   Also look at Security Groups in the left-hand menu: there are often old groups with no machine assigned. Delete them so they do not confuse you.

4. Open 22 only to your IP, and only while you use it

   Find out your public IP by searching "what is my IP" in the browser from the network you are going to work from. In Lightsail, Networking tab, click the pencil on the SSH rule, tick Restrict to IP address and type yours. In EC2, when editing the rule for 22, under Source choose My IP and AWS fills it in for you.

   If you work from several places (office and home), add one rule per place, not one open to everyone. And if your connection changes IP often (common with home fibre and always with mobile data), accept that you will have to update it from time to time: it takes a minute.

   The truly good habit: delete the rule for 22 when you finish. You log in to the machine a few times a month; the rest of the time that door does not need to exist. When you need it, add it with your IP, do your work and remove it. With no port 22 there are no SSH password attacks, and no extra programs to keep watch over.

5. Check from outside that nothing is left open

   Trust, but verify. From a terminal on your computer (PowerShell on Windows), run this against your machine's IP:

   Test-NetConnection 83.45.120.7 -Port 3306

   On Mac or Linux, nc -zv 83.45.120.7 3306. If it says it connected, the port is open to the outside and you need to go back to the previous step. Try it with 22, 3306, 3389, 10000 and 8080. There are also websites that check for you (search "check open ports"); try to do it from a different network to the one that has 22 allowed, for example from your phone.

   Even if a port is open in the firewall, the program behind it may not answer (MySQL usually listens only locally). Do not rely on that: close it in the firewall anyway.

6. Alternatives so you never have 22 open

   If you log in to the machine often, there are ways to do it with no open port at all:

   • Lightsail browser terminal: the Connect using SSH button on the machine's page. Lightsail connects on its own even if you have deleted the rule for 22 from the firewall; it does so through an internal AWS route. For occasional tasks, it is enough.
   • Session Manager in EC2: on the machine, Connect button, Session Manager tab. It requires the machine to have the SSM agent (included in AWS's Amazon Linux and Ubuntu images) and a role with the AmazonSSMManagedInstanceCore policy. In return, zero open ports, and every session is recorded in CloudTrail with who logged in.
   • EC2 Instance Connect: the EC2 Instance Connect tab under the same Connect button. It still needs 22 open, but only to the range of AWS IPs published for your region, not to the whole internet.

   With any of these, there is no longer any excuse for having 22 open to the world.

What can go wrong