Remote Relay: can I turn off 9901..9903, leaving only 443/tcp?

Evolution's Remote Relay service by default listens on ports 9901..9903/tcp, but for years I've been configuring the services to allow an extra port: 443/tcp, which is typically used for secure web (Evolution's remote relay stream is encrypted, but not HTTPS).

I've written about configuring Remote Relay with 443/tcp in this blog post.

A customer's IT consultant asked if it we could turn off 9901..9903/tcp, requiring all customers to use 443. From a security point of view, this is a really fair question, asking if we can close open ports, but I recommended against it and am noting my rationale here.

This sounds like a good idea, but in practice it's of no benefit:

First, the Evo client installer defaults to 9901/tcp, and you’d be adding a step (changing the port number) to every customer install, one more thing they have to get right even though the default works fine now. Supporting new customer installs is hard enough as it is.

Second, an increasing number of customer firewalls are doing SSL certificate validation on 443/tcp (because it’s mainly used by HTTPS), and since Evo uses baked-in self-signed certs that do not chain down from a root certificate authority, these connections are considered bogus and reset. This prevents the customer from connecting to Remote Relay.

When this happens, moving back to 9901/tcp sometimes gets around that issue, though some firewalls detect SSL on any port and perform the same shenanigans. These customers will require whitelisting in their firewalls.

I suppose you could close 9902 and 9903/tcp, which are almost never used, but that makes some kinds of troubleshooting more difficult because I sometimes have customers change to 9902/tcp so that I can run Wireshark (a network sniffer) on their connections, this altered port making it easy to pick out their traffic.

I understand the idea of trying to close “unneeded” ports, but attack surfaces are about services, not ports, and since all four (443, 9901..9903/tcp) go to the same service — Remote Relay — closing 9901..9903 only reduces the apparent attack surface, not the actual attack surface.

I recommend against this.

As I hear alternate rationale, I'll update this post.