6

The mysql user cannot use ports below 1024 because these are reserved for the root user.

Apache, on the other hand, can use port 80. Apache runs as root before it runs as Apache and thus it can use port 80. It can even listen to port 81 and any other port.

However, when I tried to get Apache to listen on port 79, it did not work. I tried to listen on port 1 too, and that did not work either.

When I change the Apache settings, Apache restarts just fine, but it doesn’t actually work on the web.

Can I use port 1 on the web?

|improve this question
  • You can use capabilities instead of root. The only capability you need is cap_net_bind_service; Root gives to many capabilities. – ctrl-alt-delor Aug 25 '14 at 14:58
  • 3
    What do you mean by "on the web it does not work"? Are you trying to access your website on port 1 from a random place on the web? (i.e. possibly behind firewalls/proxies/NAT/whatever) – Mat Aug 25 '14 at 15:07
  • I've used port 81 without issue in the past, however, it was for strictly development purposes, port 81 would cause the load balancer to query a different server. You should only use 80/443/8000/8080 on the web, 80/443 for production for maximum accessibility. – Tyzoid Aug 25 '14 at 17:16
24

I'm going to use Firefox as an example, because its open source and easy to find the information for, but this applies (probably with slightly different lists of ports) to other browsers, too.

In August 2001, CERT issued a vulnerability note about how a web browser could be used to send near-arbitrary data to TCP ports chosen by an attacker, on any arbitrary IP address. This could be used to, for example, send emails which would appear to come from the user running the web browser. In order to mitigate this, Mozilla (as well as many other vendors) blocked Firefox from accessing certain ports.

The two ports you tried, 79 and 1, happen to be on the blocklist. The source contains the full list of blocked ports. You can (on your browser) override this list using the preferences network.security.ports.banned.override and network.security.ports.banned. This isn't useful on the Internet in general, as you'd have to convince everyone who might visit your site to go to about:config and change them.

(Note: Current versions of Firefox will give an error message explaining that if you try to browse to a site on a blocked port.)

In general, there is little reason to use additional HTTP ports, at least externally. If you have to, prefer traditional extra ports like 8080, 8000, etc. that are far less likely to be blocked or at least ones outside of the IANA-assigned system ports range (0-1023). See the IANA port registry for more details.

|improve this answer
  • Use "curl" or similar command line tool to test this out on your own setup. – Steve Midgley Aug 26 '14 at 7:43
  • also note that ports 0 - 80 are on the reserved ports list ( en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers ) and so it is not a good idea to use them. In fact it is not a good idea to use any port that is listed as reserved on that list as it is HIGHLY likely that some users will be using that port for its intended use. – MD-Tech Aug 26 '14 at 9:03
  • 1
    @MD-Tech: With a grain of salt, though. A considerable range of the reserved ports is ancient cruft and total bullshit from a current day perspective. Such as e.g. port 1 TCP which the OP was trying to use, referring to a protocol exclusively used by an operating system for SGI workstations with the last release in 1998, the last maintenance update around 2005, and currently being in "officially retired" state according to the vendor. Nobody is seriously using ports 3 to 10, 13 is obsolete, 17 is useless, 11 and 19 are not used anywhere because they're built-in exploit features, etc etc. – Damon Aug 26 '14 at 13:20
  • @MD-Tech: Note that I am not advocating the "clandestine" use of reserved ports (this means confusing people which is never good, and there remain enough "legitimate" numbers you could use). But for the most part, it's "harmless" because nobody is seriously using these anyway, and if someone is indeed, you won't notice. – Damon Aug 26 '14 at 13:22
  • @MD-Tech the IANA registry is the authoritative source of that list. – derobert Aug 26 '14 at 13:34
6

apache restarts just fine but on the web it does not work.

Port 80 is the default HTTP port for browsers as well as servers. This means in order to access a server that's operating on a non-standard port from a browser, you need to include the port in the address, e.g.:

http://localhost:79/rest/of/url

Without the :79 after the hostname, the browser will try to access port 80 and get nothing since apache is using something else.

|improve this answer
1

You can run any service on any port (modulo privileges). That HTTP is on port 80 is pure convention, there's no technical reason to do this. So yes, you could run HTTP on port 1 (unless it is being used by another program). If it didn't work for you, then either you still need to fix the server configuration (check what netstat -ntl says), or, as goldilocks pointed out, you simply were not aware that for HTTP on any port with number other than 80 you need to tell the browser the port number as well.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.