Issue
- When performing a network scan on a Liferay PaaS environment, ports 80, 443, and others appear to be in open state. Will this allow HTTP requests to be successful?
Environment
- Liferay PaaS
Resolution
This behavior is expected and does not represent a security threat. Liferay PaaS projects reside on a shared cluster, meaning firewall rules are shared across all projects on that cluster. The Load Balancer acts as a proxy via the Google Front End (GFE).
To verify your security and routing, follow these steps:
- Examine your project's LCP.json files.
- Verify that the
"external": truesetting is only applied to services you explicitly intend to expose. - Confirm that no unexpected services are mapping to these ports.
Additional Information
- While the firewall rules may show various ports as open (e.g., 8080, 9200), the cluster's routing service will not forward any requests to your specific environment unless you explicitly expose those ports within your configurations.
- See Google's Open Ports documentation for more information.