1

I know that the default TCP port for MS SQL Server is 1433 and it is better to change that for some security reasons. But I want to know which port is better to choose instead of 1433 for SQL Server in order to work properly and not to intervene with the work of other programs? What if I choose a port which is already used by another program?

Thanks for your time!

closed as primarily opinion-based by Erik Darling, RDFozz, Md Haidar Ali Khan, hot2use, Colin 't Hart Aug 2 '18 at 9:46

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 8
    I've always found changing the port for security reasons to be a bit underwhelming. If someone is scanning ports on an IP address, it doesn't matter if SQL Server is on 1433 or 143300. The scan will take maybe seconds and report SQL Server either way. – Erik Darling Aug 1 '18 at 18:18
  • 3
    How do you know it is better to change the port? If someone can get to the machine they can find the port. – Aaron Bertrand Aug 1 '18 at 18:50
  • 3
    I can't stress this enough, changing the port does not add security. Period. It may take longer to identify which port but we're talking a matter of seconds. – Sean Gallardy Aug 1 '18 at 19:44
  • To further add to the chorus, IMO only bother with this if you need to punch holes in firewalls for named instances or compliance absolutely requires it and you have no other recourse. Outside of a reverse proxy I don't know a really good way to get around this. – Ali Razeghi Aug 1 '18 at 23:22
  • 1
    This is called “Security by Obscurity” and sometimes implemented in services exposed to the internet to prevent automated bots from running reconnaissance scans on known ports and services behind them. However, as others mentioned, for a database server - which will be in a secure network and hopefully not exposed to the internet directly - there is no security advantage. – Marcin Gminski Aug 2 '18 at 1:00
4

This question may be better suited to https://security.stackexchange.com/ as the idea and implications are not at all specific to SQL Server, they apply to any other internal service.

Changing the SQL Server instance port generally adds very little to security - it is a "theatre" action rather than a real security benefit, something to put on a checklist to make it look like you are doing lots for a security-in-depth policy[1]. If the browser service is still open anyone getting in can ask that what port SQL is listening on. Multiple instances of SQL on different ports is not uncommon so automated attacks against SQL Server will generally scan for instances on other ports if one is not found on 1433, while an attack could take some tens of seconds longer an automated attack bot has all the time in the world to wait.

If the outside world can see port 1433 then that is the problem (your firewall/other setup is too open) and changing ports probably won't fix that because the new port will likely be open to the world too. If an attacker is inside you infrastructure so can see the SQL Server listening port for that reason then you have a significant security problem elsewhere that moving SQL's port also won't help with.

[1] NOTE: I don't mean to imply that security in depth is a bad thing, it very much isn't. Security in depth should be a core goal of all environments. But try to avoid security theatre which adds hassle but not actually any real security benefit when you could be spending your time doing something else that actually does improve security.

Not the answer you're looking for? Browse other questions tagged or ask your own question.