Security

Ask something
Discussion Locked

SSL Port problem w/ HTTPS connection

0 helpful
7 replies

by 262noni

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We are running MS proxy on our server and are having problems making a HTTPS connection (error msg:12204 SSL port not specified). From the Microsoft website, I learned that MS proxy server connects to HTTPS only through port 443. Additional ports may be configured but it is not recommended as this would pose some security problems. One of our users needs to connect to a site using a port other than 443. What sort of problems will I expose our network to if I configure the server to access a port other than 443. Is there a precautionary measure I could take to avoid such problems?

7 replies

by colin

Just open the port for outbound on the port you need. If you dont allow inbound connections to the port there should not be a security problem.

by joseph moore

The security concern is that if the port used is a common "hacking" port.
For example, say your user needed the SSL to use TCP port 139 on your web server (for whatever bizarre reason!). So, you open TCP port 139.
Well, that is a very common port to be scanned on the Internet; it is the Windows File & Print Sharing port. If it is found open, it will be hit. Now, since you are running SSL web services on that port on your wer server, a Internet-based user could not connect to the port and view shared folders on your web server, BUT if you misconfigure your firewall and allow access to ALL protected machines over port 139, then you are gonna have a problem. Then, a Internet-based hacker could try and attack all of your internal LAN machines over port 139.
That would be bad!

So, I think that that is the only concern here. Just make sure everything is as it should be, and I see no problem setting SSL on a different port.

hope this helps

by leon_guerrero

I also run Proxy 2.0 and ISA. We have client sites we need to log into using HTTPS/SSL on ports other than 443. What we do is add the ports and then create a packet filter to only allow the IP address of the authorized site to that newly created port(s). The reason it is a security risk is because your opening up another port and exposing it. There are thousands of ports you can choose just make sure its not one of the popular ones that hackers scan for.

This discussion is closed to new replies.