[Sn1F3rt]

Hi guys,

The default port for VestaCP is 8083. In this tutorial, I shall be showing you how to change it.

1. Log into your Vesta Control Panel.
   
2. Click on Firewall on Your Vesta menu
   
3. Click on the Green Plus button to add the New Port
   
4. I will be changing my port to 2019.  For the new port, add the details as follows:
   
   
   Code: (Select All)

   Action:  ACCEPT

Protocol: TCP

Port: 2019

IP Address: 0.0.0.0/0
   
   Then click Add, to add the new port to your Firewall.
   
5. Next edit the NGINX config file to listen to the new port, in my case 2019.
   
6. To do this, login into your SSH client. Make sure you are the root user or a user with root (sudo) privileges.
   
7. Issue the following command:
   
   Code: (Select All)

   sudo vi /usr/local/vesta/nginx/conf/nginx.conf
   
   
   
8. Press the INSERT key.
   
9. Scroll down to the area which says:
   
   Code: (Select All)

   listen 8083;
   
   
   
10. And change it to:
    
    Code: (Select All)

    listen 2019;
    
    
    
11. Then exit out of the editor by pressing Esc key and then type :wq and press Enter.
    
12. Then restart Vesta using the Command below.
    
    Code: (Select All)

    sudo service vesta restart
    
    
    
13. Now log into your VestaCP using the new port as follows.
    
    Code: (Select All)

    Your-IP-Address:2019
    
    
    
14. Finally, you may delete the old port, 8083.
    
    To delete the port 8083 from your Firewall, just click on Firewall on your Top Menu within Vesta.
    
    Then hover over port 8083 and delete it.
    

That’s how to replace port 8083 on VestaCP. Hope you guys enjoyed the tutorial.

Regards,

[ikk157]

May I ask if this by any chance breaks anything in vestacp?

Also, is there any advantage to this? Or is it just for the ones that might already have something else occupying that port?

[Sn1F3rt]

Nay this wouldn't break anything in Vesta. It's indeed good you change the default stuff, as it'll prevent everyone from getting to the login interface. Personally I've Vesta running on a completely separate port than 8083.

It might as well afford protection against bruteforce attacks. Although fail2ban is very efficient, still this is extra protection.

And yes, this also helps if you've something else running on Vesta's default port, which can be more cumbersome to change than this one. This is a really simple tutorial as well as a process which anyone can follow from newbies to intermediates to advanced users.

Regards,

[ikk157]

Nay this wouldn't break anything in Vesta. It's indeed good you change the default stuff, as it'll prevent everyone from getting to the login interface. Personally I've Vesta running on a completely separate port than 8083.

It might as well afford protection against bruteforce attacks. Although fail2ban is very efficient, still this is extra protection.

And yes, this also helps if you've something else running on Vesta's default port, which can be more cumbersome to change than this one. This is a really simple tutorial as well as a process which anyone can follow from newbies to intermediates to advanced users.

Regards,

How would this help protect from bruteforce attacks?

I’m pretty sure whoever has the intention to do such a bad thing won’t find it all that difficult to find the new vesta port. Doesn’t seem like a good way to protect from brute force attacks at all, unless, in the best case scenario, the attacker is straight up dumb.

[Mashiro]

It simply protects from automated brute force attacks which today are mostly 99% of all attacks thanks to huge automated botnets. 1% are the people you mentioned that would simply run a port scan or similar to find the new port.

That's usually how changing a default port to a non default port helps with brute force attacks. Generally this is helpful because it really stops all automated brute force attacks and thus can even drop down the load on the system (depending on the volume of the brute force attack).

[ikk157]

It simply protects from automated brute force attacks which today are mostly 99% of all attacks thanks to huge automated botnets. 1% are the people you mentioned that would simply run a port scan or similar to find the new port.

That's usually how changing a default port to a non default port helps with brute force attacks. Generally this is helpful because it really stops all automated brute force attacks and thus can even drop down the load on the system (depending on the volume of the brute force attack).

Ah I see. But wouldn’t something like a cool down when entering a wrong password be even better? The sort of thing where you have to wait an X amount of time if you enter the wrong password a good number of times. And the time increases if you proceed to enter wrong passwords.

For example:
Let’s say i type in the password wrong 3 times. It then says I have to wait 10mins before i can try again. Then I type it wrong again. It then says I have to wait 20mins before I can try again. And so on...

I don’t know if I’ve explained this clearly, I feel like I’ve done a horrible job at that

[Mashiro]

This would help a bit if the automated attack would happen from a single or only a few attackers but I already mentioned that nowadays we have huge botnets made out of millions of devices including IoT stuff like webcams, fridges and etc... also even routers, of course normal computers and servers. So handling all requests from such huge botnets even if you don't get attacked by all bots is still a big load for the system (depending on its specifications). Small servers will break down under the load easily and quicker. A DDoS attack as we know it that is, actually. It has the intent to break the system and make it part of the botnet though instead of simply getting it to go down.

Think over the edge of the plate you are eating from.

[tiwil]

Changing port is good to prevent any hackers attempt to get into your VestaCP panel. But if you use hard password, it'll be more harder even if they know the port.

So basically, change the port and use hard password.
Anyway, thanks for the tutorial!