Two things decide what the network sees: the address a program listens on and what the filter lets through. You start with the first — an inventory on the server itself.
The attack surface of a server is everything that can be reached from the network. Every open port is a program that may have a vulnerability and an entrance where passwords can be guessed. So only what the server needs for its job stays open to the outside.
The inventory is sudo ss -tlnp: all listening TCP sockets with their programs (the “Who is listening on a port” lesson). Without sudo the Process column is empty — ss does not show other users' processes. For each line you settle three things: the socket address, whose program it is and who needs it.
Address in Local Address |
Who can connect |
|---|---|
127.0.0.1, 127.0.0.53 |
only programs on this same machine |
0.0.0.0 |
clients coming to any IPv4 address of the machine, that is, from the network |
[::] |
the same for IPv6 |
A socket on 0.0.0.0 or [::] is visible from the network unless a firewall closes it. A socket on 127.0.0.1 is never visible from the network: a packet from another machine never arrives at that address.
Take the socket inventory
On the server itself, list the listening TCP sockets together with their programs.
First, predict
The scanner outside found four ports. Will the inventory have sockets it did not see?
Now start the exercise, run the command and compare your prediction with the output.
In the inventory postgres has 0.0.0.0:5432. Only the shop application on this same server needs the database. What will you do with it?
-
The shop application uses the database: a stopped database closes the port and the shop along with it.
-
A scanner finds any open port:
nmap -p-checks all 65535. The port stays visible from the network. -
The database accepts the connection, so the code that checks passwords is reachable from the network. nmap sees the port as open.
The database client is on this same machine, so the 127.0.0.1 address is enough for it.