should I block 9000 port when I using php-fpm?

Question

Should I block 9000 port when I using php-fpm?

I want to know that when I open a port 9000 and run php-fpm, can the attacker execute specific file by request my server using port number 9000.

Lissy

Port 9000 should be closed for incoming connections in your firewall. There's no reason to allow external requests to PHP-FPM directly. – Warm

@MagnusEriksson Thanks you. Did you mean that it is possible to execute external php file by attacker using 9000 port on my server? – Lissy

You shouldn't have more ports open than necessary. Basically, block all ports except the ones the application needs to work (like port 80/443 for the web server for example). – Warm

Answer 1

You can conf it with

listen = 127.0.0.1:9000

to only allow it been accessed from localhost

And check it

$ netstat -tlnp | grep 9000
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      -

Novelistic

Answer 2

I changed the 9000 PHP-FPM port because they put me a malware because of the default port. So it's better you change the 9000 port to another for PHP-FPM

Eggshell

As you said, someone can access your FPM port. Hence you should block inbound traffic on your FPM port so that no one can access your FPM server. – Lissy

Changing port wouldn't secure your server if you keep it open to public. You have to configure it to listen ONLY to 127.0.0.1 – Plentiful