Which standard ports do common server services use?

SSH uses port 22, FTP port 21, Mail port 25, DNS port 53, HTTP port 80, and HTTPS port 443.

Dedicated Server: Linux Security Tips

Discover how to improve your Linux server's security with essential tips to prevent unauthorized access and protect your services → Learn more now

10 November 202611 min read6 Views0 helpful

Introduction

This guide provides some tips and advice on how to make your Linux server more secure. Since servers must be accessible from outside, a basic protection against unauthorized access is definitely recommended and should not be neglected.

Info

Please note that these instructions are not exhaustive and more detailed information can be found in other areas of the ZAP documentation. (e.g., 2FA (SSH))

Tip

The easiest way to protect your server is always the same, no matter which server: Use strong passwords, regularly update your services, and generally pay attention to which services you install and which instructions you follow.

Securing SSH

SSH (Secure Shell) is a service that allows you to remotely access your server's console to execute commands. Here is how to set up SSH on your server: First Access (SSH)

By default, SSH uses password-based login. However, this has the major disadvantage that authentication can be relatively easily bypassed by brute-force attacks, especially if you use a weak password for your SSH access. If you choose the password method, please use a strong password.

To better protect your server against unwanted SSH access, you should enable authentication exclusively via SSH keys and disable password login. See the SSH Key Guide for VPS (content applies similarly to Dedicated Servers), which explains how to generate and add SSH keys.

Port Configuration of Your Services

Service	Port
SSH	22
FTP	21
Mail	25
DNS	53
HTTP	80
HTTPS	443

Services like SSH or FTP always use the same default ports (some of which are listed in the table above). If an external attacker tries to brute-force your SSH service, they first need to know which port SSH uses. If you do not change these ports, ports 22 and 21 are usually the targets to directly execute commands on the server or access files via FTP.

To prevent this, we recommend configuring the ports of standard services to custom values. The next section explains how to do this:

Warning

Your desired port must be between 1024 and 65535 and must not be already in use!

You can view some standard ports with cat /etc/services to avoid choosing an occupied port.

Changing the SSH Port

To change the SSH port, you need to edit the configuration file. This is usually located at /etc/ssh/sshd_config. If not, you can find it with the following command:

Code

find / -name "sshd_config" 2>/dev/null

Open the file with nano (as root or using sudo).

Code

sudo nano /etc/ssh/sshd_config

Insert your desired port after Port. If Port is commented out (e.g., #Port 22), remove the "#" and replace 22 with your chosen port. Save the file (in Nano with Ctrl + o) and close it (Nano: Ctrl + x).

You must now restart the SSH service for the changes to take effect.

Code

# On Ubuntu/Debian/CentOS for example
sudo systemctl restart sshd

Changing the FTP Port

If you have installed an FTP service like proFTPd, you can also easily change the port via the configuration file. The procedure is similar to SSH.

Find the configuration file proftpd.conf

Code

find / -name "proftpd.conf" 2>/dev/null

The file is usually located at /etc/proftpd.conf (CentOS) or /etc/proftpd/proftpd.conf (Ubuntu, Debian). Open the file with nano, remove the "#" before port, and enter your desired port. Observe the notes above to avoid choosing an invalid port.

Tip

Use Ctrl + W to search in nano.

Code

nano /etc/proftpd/proftpd.conf

Using a Firewall

The principle of external accessibility of a server is always the same: a port must be open for the server to be reachable from outside. For SSH, this is by default port 22/TCP. (see above how to change the default port)

The problem is that this port is now accessible to everyone, regardless of who, from where, and with what intent. This represents a major security risk, as attackers could flood the server with login attempts to either guess the correct password (through brute force if password login is still enabled) or to overload the server network (e.g., DDoS).

To reduce these effects, you can apply firewall rules that restrict access to open ports.

There are two methods you can use for this:

IPTables: The classic Linux firewall with many options but somewhat more complex to use.
UFW: A simpler interface for IPTables that avoids complicated commands but is somewhat more limited.

Ultimately, the choice is yours. Depending on your application, you might need the flexibility of IPTables, but sometimes UFW is sufficient (e.g., if you just want to open/close ports – better than nothing!).

IPTables

In this section, you use IPTables to create rules that limit the number of connection attempts. Explanations for each command are given below the code block.

Note that this rule is only activated for port 22 (value after --dport) and commands would need to be adjusted for other services.

Info

The following commands do not work on every Linux distribution but on most popular distros.

First, log in to your Linux server. If you need help, follow our First Access (SSH) guide. Then execute the following commands in the given order.

Code

iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 2 --connlimit-mask 32 -j DROP
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP

The first rule drops packets if there are more than 2 connections in the TIME_WAIT state to port 22 from a single IP.
The second rule adds the IP address of a new connection to the recent list.
The third rule drops new connections from IP addresses that have attempted more than 2 connections in the last second.

UFW

As described above, UFW is a “simpler” interface for IPTables. The first step is to install UFW, as it is not included by default in all Linux distributions. You should run the commands as root or with sudo.

First, log in to your Linux server. If you need help, follow our First Access (SSH) guide. The following instructions have been tested with Debian and Ubuntu but should also work on other Linux distributions.

First, update the apt directory and existing services.

Code

sudo apt update && sudo apt upgrade -y

Then install UFW via apt.

Code

sudo apt install ufw -y

Make sure the installation was successful by running the following command.

Code

sudo ufw status
> Firewall not loaded

To avoid locking yourself out of your server, you must allow the SSH service before enabling the firewall.

Warning

If you have already changed the SSH port, please enter the new port here instead of 22.

Use the following commands to allow the SSH service.

Code

sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status

A successful output should look like this:

Code

Status: active
  
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)

Now run the following command, which limits connections to 6 per minute.

Code

ufw limit 22/tcp

Info

UFW only allows limiting to 6 connections per minute. The UFW limiter is quite simple and not suitable for all situations. For a more detailed and flexible configuration, we recommend using IPTables directly.

Tip

The firewall (whether IPTables or UFW) only counts connection attempts “blindly” and blocks accordingly. With Fail2Ban, you can check log files for suspicious activity. The next section explains how to install and activate Fail2Ban.

Additional Protection with Fail2Ban

Fail2Ban is a service that blocks IP addresses that try to log in to the server with likely malicious intent. Fail2Ban monitors log files for suspicious activity and thus secures your system relatively easily and effectively.

After installation, Fail2Ban comes with preconfigured settings for some commonly used services, including:

apache
lighttpd
sshd
qmail
postfix
Courier Mail Server Additional services can be easily added using regular expressions (RegEx) and specifying the desired log file.

As an example, let's look at an entry in /var/log/auth.log. This file contains all SSH login attempts, whether successful or failed.

Here is the entry:

Code

Dec 2 12:59:19 vps-zap515723-2 sshd[364126]: Failed password for root from 92.117.xxx.xxx port 52504 ssh2

Fail2Ban uses this log file and monitors it for failed authentications. Since the log file directly contains the attacker's IP address, Fail2Ban can block this IP after several failed attempts.

Installing Fail2Ban

First, log in to your Linux server. If you need help, follow our First Access (SSH) guide. You should run the commands as root or with sudo.

Code

sudo apt update && sudo apt upgrade -y
sudo apt install fail2ban

After installation, you can check the status directly with systemctl: (Press Ctrl+C to exit systemctl)

Code

systemctl status fail2ban.service
* fail2ban.service - Fail2Ban Service
     Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor pres>
     Active: active (running) since Sat 2023-12-02 13:10:33 UTC; 24s ago
       Docs: man:fail2ban(1)
    Process: 23988 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, statu>
   Main PID: 23989 (fail2ban-server)
        CPU: 409ms
     CGroup: /system.slice/fail2ban.service
             `-23989 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

Dec 02 13:10:33 vps-zap515723-1 systemd[1]: Starting Fail2Ban Service...
Dec 02 13:10:33 vps-zap515723-1 systemd[1]: Started Fail2Ban Service.
Dec 02 13:10:34 vps-zap515723-1 fail2ban-server[23989]: Server ready

Configuring Fail2Ban

Fail2Ban is now installed but not yet active or configured. Check /etc/fail2ban, where you should currently find the following files:

Code

action.d fail2ban.d jail.conf paths-arch.conf paths-debian.conf
fail2ban.conf filter.d jail.d paths-common.conf paths-opensuse.conf

To create an active “jail,” you need to create a file named jail.local. Simply copy the contents of jail.conf into the new file and open it:

Code

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

You can now make all settings in the jail.local file, including which services to monitor. Look only at the part after [Default]. The Default section is for general basic settings.

Scroll down a bit until you find this section and adjust it, for example, like this:

Attribute	Explanation	Value
ignoreip	IP addresses that should not be blocked	127.0.0.1/8
ignorecommand	Not relevant.
bantime	How long an IP address remains blocked	1h
findtime	Time period in which failed logins are considered	10m
maxretry	Number of failed attempts that lead to a ban	5

Code

# can be defined separated by spaces (and/or commas).
#ignoreip = 127.0.0.1/8 ::1

# ignorecommand = /path/to/command <ip>
ignorecommand =

# "bantime" is the number of seconds a host is banned.
bantime  = 1h

# A host is banned if it has "maxretry" failures within the last "findtime"
# seconds.
findtime  = 10m

# "maxretry" is the number of failures before a host is banned.
maxretry = 5

With this, you have completed the basic settings. To monitor the SSH service, scroll further down to the [sshd] tag. If you changed your port, you should enter it under port.

The [sshd] tag looks like this:

Code

[sshd]

enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 4

Tip

As you can see, you can also make individual settings for each service (here, e.g., maxretry, which is lower than the default value). Although you have already made the general settings, you can override most settings per service. If you do not, the general setting is used.

Now you just need to restart Fail2Ban to start monitoring.

Code

sudo systemctl restart fail2ban.service

Checking Fail2Ban Functionality

If you have access to a VPN or a second server, you can test whether Fail2Ban works by blocking yourself. Using a VPN or a hotspot via your phone should give you a different IP to test Fail2Ban.

Warning

Do not test this on your normal network, as your own IP address could be blocked and you could lock yourself out.

Try to establish an SSH connection to your server (with a different IP!) and enter the wrong password each time. The result should look like this:

Code

root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
root@185.223.29.xxx: Permission denied (publickey,password).
root@vps-zap515723-2:/var/log# ssh root@185.223.29.179
root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
^C
root@vps-zap515723-2:/var/log# ssh root@185.223.29.xxx
ssh: connect to host 185.223.29.xxx port 22: Connection refused

As you can see, the connection is now refused by your Fail2Ban-protected server (Connection refused instead of Permission denied).

Now show the status of Fail2Ban. Here you see that an IP address has been banned.

Code

fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 4
|  |- Total failed:     8
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   xxx

If you want to unban the IP again, you can do so with the following command: fail2ban-client set sshd unbanip {your IP}.

Info

If you have an unusually high number of IP bans, it is advisable to increase the ban time with each failed attempt to reduce the number of possible login attempts.

Code

[sshd]

enabled = true
port    = 22
filter  = sshd
logpath = /var/log/auth.log
maxretry = 4

bantime = 1h
# Ban time should increase with each ban of this IP
bantime.increment = true
# Scaling factor of 24 hours (1h,24h,48h,3d,4d....)
bantime.factor = 24
# Maximum ban time = 5 weeks
bantime.maxtime = 5w

Securing Your Webserver with Cloudflare

Many use Cloudflare as a DNS manager for their domain. Cloudflare not only has one of the largest networks worldwide, which leads to faster loading times, lower latency, and better user experience, but also protects your websites from DoS/DDoS attacks, including flooding and new attack types discovered daily. In this guide, you will learn how to protect your webserver from attacks.

We assume your domain is already managed by Cloudflare. If not, you can follow their guide to transfer your domain. In the Cloudflare dashboard, go to the DNS Records tab and make sure your entry for your webserver has the orange cloud and shows "Proxied."

Then all traffic through your domain runs via Cloudflare and from there to your server – legitimate traffic. However, your server is still accessible from outside Cloudflare. For this, you must restrict access to ports 80 and 443 of the TCP protocol on your Linux server and allow only legitimate Cloudflare traffic.

You can manually create firewall rules using the Cloudflare IPv4 list and the Cloudflare IPv6 list.

Alternatively, save time by using tools like Cloudflare-ufw to quickly import these firewall rules in bulk. Make sure you do not have separate rules that allow unrestricted access to your webserver except the ones you just added, otherwise the rules will not work.

Conclusion – Your Server Is Now Much More Secure!

This guide has shown you some basic and advanced functions to secure your Linux server. If you have implemented all recommendations relevant to your system, your server is already significantly more secure than before – congratulations!

Further measures are of course possible:

2FA (SSH)
Add more configurations for Fail2Ban
Set up email notifications in Fail2Ban
And much more...

FAQ

Frequently asked questions

Use strong passwords, regularly update your services, and be careful about which services you install and which instructions you follow.

Password-based SSH login can be easily bypassed by brute-force attacks, especially with weak passwords. It is recommended to enable authentication only via SSH keys and disable password login.

SSH uses port 22 by default. Since services like SSH or FTP always use the same default ports, these are common targets for automated attacks – appropriate protection measures are recommended.

Feedback

Was this article helpful?

Your feedback helps us prioritize and improve content.

0 of 0 Users found this article helpful.

Personal support

Need more help than the guide provides?

Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.

Which 🍪 cookies would you like to allow?

Dedicated Server: Linux Security Tips

Introduction

Securing SSH

Port Configuration of Your Services

Changing the SSH Port

Changing the FTP Port

Using a Firewall

IPTables

UFW

Additional Protection with Fail2Ban

Installing Fail2Ban

Configuring Fail2Ban

Checking Fail2Ban Functionality

Securing Your Webserver with Cloudflare

Conclusion – Your Server Is Now Much More Secure!

Frequently asked questions