Wetin be port and how Linux services dey listen

Wetin port really be

Port na number wey dey let one server run many services at once without their traffic mix up. Your VPS get one IP address, but e fit run web server, SSH server, and database at the same time. When packet arrive, operating system need to know which one e dey for. Port number na the answer. Web traffic dey go to port 443, SSH dey go to port 22. IP address dey carry packet reach your server; port dey carry am reach the right program for that server.

Port na 16-bit number: 16 bits dey give 0 to 65535, and dem reserve 0, so for practice, ports dey run from 1 to 65535. Ports wey below 1024 na "well-known" ports and you need root to open dem, na why standard services dey stay there: 22 for SSH, 80 for HTTP, 443 for HTTPS, 53 for DNS. Anything wey above 1024 na for ordinary programs.

Two kinds of port dey: TCP and UDP, and port number for one no be the same as the same number for the other. TCP na connection-based protocol wey most services dey use, like SSH, HTTP, and databases. UDP no get connection (connectionless) and dem dey use am for things like DNS and some VPNs. When you open firewall, you usually name which one, for example 22/tcp.

To "listen" mean say program dey wait for port

Program wey wan receive connections dey ask kernel to "listen" on a port. From that moment, the port open for the machine and the program go answer anything wey arrive there, if firewall allow am. Port wey nothing dey listen for, e go just refuse connections. So the first question for any security check na: wetin dey listen, and where?

The command to answer that one na ss:

sudo ss -tlnp

The flags mean TCP (t), listening sockets only (l), numeric ports (n, so you go see 22 instead of ssh), and the process wey dey own am (p). Typical result:

State   Recv-Q  Local Address:Port   Process
LISTEN  0       0.0.0.0:22           sshd
LISTEN  0       127.0.0.1:5432       postgres
LISTEN  0       [::]:80              nginx

The Process column go tell you which program dey own each port, na how you go take track down anything wey you no mean to leave running.

Local Address column na the part wey matter pass

Read the address for front of each port carefully, because e dey decide who fit reach the service. Three cases dey wey you go see constantly.

0.0.0.0:22 mean say "listen on every IPv4 address wey this machine get," including the public one. People fit reach the service from internet via IPv4, if firewall allow am.

[::]:80 mean the same thing for IPv6: listen on every IPv6 address, including the public one. Many programs dey bind here by default, and for Linux, a :: socket fit accept IPv4 as well.

127.0.0.1:5432 mean say "listen on loopback only." 127.0.0.1 na the address machine dey use to talk to itself, and nobody fit reach am from anywhere else. Service wey bind here, na only from the same server dem fit reach am, never from internet, no matter wetin your firewall talk. That Postgres line wey dey above na safe by design.

The practical rule easy to understand: database, cache, or admin panel wey only your own applications dey use, e suppose bind to 127.0.0.1, no be 0.0.0.0. If e no dey listen on public address, attacker no go get anything wey dem fit reach.

To listen no be the same as to be reachable

One more distinction go help reduce confusion. Port wey open for the machine (meaning program dey listen) different from port wey reachable from outside (meaning firewall allow am). Both must dey true before remote client fit connect.

So, two layers of control dey. You decide wetin dey listen by setting each service bind address. And you decide wetin the outside world fit reach with firewall. Good server dey use both: services dey bind only where dem need to, and firewall dey deny everything wey you no explicitly allow. To read wetin dey listen with ss na step one; to decide wetin firewall permit na step two, wey dey firewalls 101 with UFW.

One small thing dey catch people for here. IPv4 and IPv6 different, and if firewall only cover IPv4, e go leave [::] services open for IPv6. That specific trap get its own post: the IPv6 firewall trap.

FAQ

How I fit see which ports open for my Linux server?

Run sudo ss -tlnp for TCP or sudo ss -ulnp for UDP. That one go list every listening socket, the port, the local address wey e bind to, and the process wey dey own am. Read the Local Address column: 0.0.0.0 or [::] mean say the service dey open for network, while 127.0.0.1 mean say e dey listen only for the machine itself.

Wetin be the difference between 0.0.0.0 and 127.0.0.1?

0.0.0.0 mean say "listen on all IPv4 addresses," including the public one, so people fit reach the service from network. 127.0.0.1 na loopback, the address machine dey use to talk to itself, and nobody fit reach am from anywhere else, so service wey bind to am, na only locally dem fit reach am. Bind your internal services to 127.0.0.1 so dem no go ever dey exposed.

I need to open port for firewall for service to work?

Only for services wey must reach from other machines. Service wey bind to 127.0.0.1 no need firewall rule because nothing external fit reach am anyway. Service for 0.0.0.0 or [::] need firewall rule to allow the traffic, and e suppose dey denied by default until you add one.

Wetin be the difference between TCP port and UDP port?

TCP na connection-based and most services dey use am, like SSH, web servers, and databases. UDP na connectionless and dem dey use am for DNS and some VPNs. The same number for TCP and UDP na different ports, so 53/tcp and 53/udp na different things. When you dey write firewall rules, you dey name the protocol, for example 22/tcp.