Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #200358 > unrolled thread
| Started by | Subhadip Ghosh <subhadip.sky@gmail.com> |
|---|---|
| First post | 2018-09-21 05:10 +0200 |
| Last post | 2018-09-24 20:50 +0200 |
| Articles | 20 on this page of 85 — 22 participants |
Back to article view | Back to linux.debian.user
Why does Debian allow all incoming traffic by default Subhadip Ghosh <subhadip.sky@gmail.com> - 2018-09-21 05:10 +0200
Re: Why does Debian allow all incoming traffic by default Roberto C. Sánchez <roberto@debian.org> - 2018-09-21 05:30 +0200
Re: Why does Debian allow all incoming traffic by default Subhadip Ghosh <subhadip.sky@gmail.com> - 2018-09-21 05:40 +0200
Re: Why does Debian allow all incoming traffic by default Roberto C. Sánchez <roberto@debian.org> - 2018-09-21 05:50 +0200
Re: Why does Debian allow all incoming traffic by default deloptes <deloptes@gmail.com> - 2018-09-21 07:10 +0200
Re: Why does Debian allow all incoming traffic by default Subhadip Ghosh <subhadip.sky@gmail.com> - 2018-09-21 19:40 +0200
Re: Why does Debian allow all incoming traffic by default Dan Ritter <dsr@randomstring.org> - 2018-09-21 19:10 +0200
Re: Why does Debian allow all incoming traffic by default Subhadip Ghosh <subhadip.sky@gmail.com> - 2018-09-21 19:40 +0200
Re: Why does Debian allow all incoming traffic by default deloptes <deloptes@gmail.com> - 2018-09-21 20:00 +0200
Re: Why does Debian allow all incoming traffic by default Subhadip Ghosh <subhadip.sky@gmail.com> - 2018-09-21 20:10 +0200
Re: Why does Debian allow all incoming traffic by default Brian <ad44@cityscape.co.uk> - 2018-09-21 21:40 +0200
Re: Why does Debian allow all incoming traffic by default David Wright <deblis@lionunicorn.co.uk> - 2018-09-21 21:50 +0200
Re: Why does Debian allow all incoming traffic by default mick crane <mick.crane@gmail.com> - 2018-09-23 01:10 +0200
Re: Why does Debian allow all incoming traffic by default Brian <ad44@cityscape.co.uk> - 2018-09-23 20:00 +0200
Re: Why does Debian allow all incoming traffic by default Joe <joe@jretrading.com> - 2018-09-23 23:00 +0200
Re: Why does Debian allow all incoming traffic by default Brian <ad44@cityscape.co.uk> - 2018-09-24 00:00 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 09:40 +0200
Re: Why does Debian allow all incoming traffic by default Gene Heskett <gheskett@shentel.net> - 2018-09-22 11:20 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 13:00 +0200
Re: Why does Debian allow all incoming traffic by default Dan Ritter <dsr@randomstring.org> - 2018-09-22 13:40 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 17:00 +0200
Re: Why does Debian allow all incoming traffic by default Gene Heskett <gheskett@shentel.net> - 2018-09-22 20:20 +0200
Re: Why does Debian allow all incoming traffic by default Richard Hector <richard@walnut.gen.nz> - 2018-09-24 05:20 +0200
Re: Why does Debian allow all incoming traffic by default Gene Heskett <gheskett@shentel.net> - 2018-09-24 05:30 +0200
Re: Why does Debian allow all incoming traffic by default <tomas@tuxteam.de> - 2018-09-24 09:10 +0200
Re: Why does Debian allow all incoming traffic by default Gene Heskett <gheskett@shentel.net> - 2018-09-24 11:00 +0200
Re: Why does Debian allow all incoming traffic by default <tomas@tuxteam.de> - 2018-09-24 11:40 +0200
Re: Why does Debian allow all incoming traffic by default Gene Heskett <gheskett@shentel.net> - 2018-09-24 14:20 +0200
Re: Why does Debian allow all incoming traffic by default Dan Ritter <dsr@randomstring.org> - 2018-09-22 20:30 +0200
Re: Why does Debian allow all incoming traffic by default Gene Heskett <gheskett@shentel.net> - 2018-09-22 22:20 +0200
Re: Why does Debian allow all incoming traffic by default <tomas@tuxteam.de> - 2018-09-22 22:40 +0200
Re: Why does Debian allow all incoming traffic by default Gene Heskett <gheskett@shentel.net> - 2018-09-22 23:20 +0200
Re: Why does Debian allow all incoming traffic by default Simon Kengelbacher <simon.kengelbacher@mail.ch> - 2018-09-22 23:50 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-23 00:00 +0200
Re: Why does Debian allow all incoming traffic by default Simon Kengelbacher <simon.kengelbacher@mail.ch> - 2018-09-23 00:20 +0200
SSH X forwarding going awry (Was: Why does Debian allow all incoming traffic by default) Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-23 11:40 +0200
Re: SSH X forwarding going awry FIXED (Was: Why does Debian allow all incoming traffic by default) Gene Heskett <gheskett@shentel.net> - 2018-09-23 16:10 +0200
Re: SSH X forwarding going awry FIXED (Was: Why does Debian allow all incoming traffic by default) Joe <joe@jretrading.com> - 2018-09-23 23:00 +0200
Re: SSH X forwarding going awry FIXED (Was: Why does Debian allow all incoming traffic by default) Gene Heskett <gheskett@shentel.net> - 2018-09-24 04:50 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-24 21:00 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-23 00:00 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-24 21:00 +0200
Re: Why does Debian allow all incoming traffic by default Joe <joe@jretrading.com> - 2018-09-24 21:30 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-26 15:50 +0200
Re: Why does Debian allow all incoming traffic by default Joe <joe@jretrading.com> - 2018-09-26 17:10 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-26 19:30 +0200
Re: Why does Debian allow all incoming traffic by default Dan Purgert <dan@djph.net> - 2018-09-22 15:50 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 16:50 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-24 20:50 +0200
Re: Why does Debian allow all incoming traffic by default Henning Follmann <hfollmann@itcfollmann.com> - 2018-09-21 15:00 +0200
Re: Why does Debian allow all incoming traffic by default Reco <recoverym4n@gmail.com> - 2018-09-21 18:30 +0200
Re: Why does Debian allow all incoming traffic by default Brian <ad44@cityscape.co.uk> - 2018-09-21 20:20 +0200
Re: Why does Debian allow all incoming traffic by default Reco <recoverym4n@gmail.com> - 2018-09-21 20:40 +0200
Re: Why does Debian allow all incoming traffic by default Brian <ad44@cityscape.co.uk> - 2018-09-21 21:10 +0200
Re: Why does Debian allow all incoming traffic by default deloptes <deloptes@gmail.com> - 2018-09-21 23:20 +0200
Re: Why does Debian allow all incoming traffic by default Reco <recoverym4n@gmail.com> - 2018-09-21 23:40 +0200
Re: Why does Debian allow all incoming traffic by default Dan Purgert <dan@djph.net> - 2018-09-22 00:10 +0200
Re: Why does Debian allow all incoming traffic by default Reco <recoverym4n@gmail.com> - 2018-09-22 09:10 +0200
Re: Why does Debian allow all incoming traffic by default Dan Purgert <dan@djph.net> - 2018-09-22 15:50 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 09:50 +0200
Re: Why does Debian allow all incoming traffic by default Reco <recoverym4n@gmail.com> - 2018-09-22 12:00 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 13:00 +0200
Re: Why does Debian allow all incoming traffic by default Reco <recoverym4n@gmail.com> - 2018-09-22 13:30 +0200
Re: Why does Debian allow all incoming traffic by default <tomas@tuxteam.de> - 2018-09-22 22:00 +0200
Re: Why does Debian allow all incoming traffic by default Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-22 22:20 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 23:40 +0200
Re: Why does Debian allow all incoming traffic by default Henning Follmann <hfollmann@itcfollmann.com> - 2018-09-22 12:10 +0200
Re: Why does Debian allow all incoming traffic by default Reco <recoverym4n@gmail.com> - 2018-09-22 12:40 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 13:10 +0200
netstat (was: Re: Why does Debian allow all incoming traffic by default) rhkramer@gmail.com - 2018-09-21 20:00 +0200
Re: netstat Reco <recoverym4n@gmail.com> - 2018-09-21 20:20 +0200
Re: netstat rhkramer@gmail.com - 2018-09-22 20:50 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-24 20:50 +0200
Re: Why does Debian allow all incoming traffic by default Henning Follmann <hfollmann@itcfollmann.com> - 2018-09-24 21:30 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-26 15:50 +0200
Re: Why does Debian allow all incoming traffic by default Pablo Álvarez Córdoba <pabloalvarezcordoba@protonmail.ch> - 2018-09-21 18:30 +0200
Re: Why does Debian allow all incoming traffic by default Subhadip Ghosh <subhadip.sky@gmail.com> - 2018-09-21 19:30 +0200
Re: Why does Debian allow all incoming traffic by default songbird <songbird@anthive.com> - 2018-09-22 00:10 +0200
Re: Why does Debian allow all incoming traffic by default Joe <joe@jretrading.com> - 2018-09-22 09:40 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 10:40 +0200
Re: Why does Debian allow all incoming traffic by default Joe <joe@jretrading.com> - 2018-09-22 13:20 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-22 17:10 +0200
Re: Why does Debian allow all incoming traffic by default Joe <joe@jretrading.com> - 2018-09-23 10:50 +0200
Re: Why does Debian allow all incoming traffic by default Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-27 14:00 +0200
Re: Why does Debian allow all incoming traffic by default Jonathan Dowland <jmtd@debian.org> - 2018-09-24 20:50 +0200
Page 1 of 5 [1] 2 3 4 5 Next page →
| From | Subhadip Ghosh <subhadip.sky@gmail.com> |
|---|---|
| Date | 2018-09-21 05:10 +0200 |
| Subject | Why does Debian allow all incoming traffic by default |
| Message-ID | <wAjZo-39S-1@gated-at.bofh.it> |
Hi, I am using Debian and the recently I learned that a standard Debian installation allows all 3 types of traffics especially incoming by default. I know I can easily use iptables to tighten the rules but I wanted to know the reasons behind the choice of this default behaviour and if it makes the system more vulnerable? I tried searching on the Internet but did not get any satisfactory explanation. It will be helpful if anybody knows the answers to my questions or can redirect me to a helpful document. Thanks, Subhadip
[toc] | [next] | [standalone]
| From | Roberto C. Sánchez <roberto@debian.org> |
|---|---|
| Date | 2018-09-21 05:30 +0200 |
| Message-ID | <wAkiJ-3fB-1@gated-at.bofh.it> |
| In reply to | #200358 |
On Fri, Sep 21, 2018 at 08:34:50AM +0530, Subhadip Ghosh wrote: > Hi, > > I am using Debian and the recently I learned that a standard Debian > installation allows all 3 types of traffics especially incoming by default. What do you mean by "all 3 types of traffics"? > I know I can easily use iptables to tighten the rules but I wanted to know > the reasons behind the choice of this default behaviour and if it makes the > system more vulnerable? The behavior you observe is likely because that is the best default that is universally applicable. > I tried searching on the Internet but did not get > any satisfactory explanation. It will be helpful if anybody knows the > answers to my questions or can redirect me to a helpful document. > Where did you search or what terms did you use? Regards, -Roberto -- Roberto C. Sánchez
[toc] | [prev] | [next] | [standalone]
| From | Subhadip Ghosh <subhadip.sky@gmail.com> |
|---|---|
| Date | 2018-09-21 05:40 +0200 |
| Message-ID | <wAksp-3ix-1@gated-at.bofh.it> |
| In reply to | #200359 |
Hi Roberto, On Friday 21 September 2018 08:51 AM, Roberto C. Sánchez wrote: > On Fri, Sep 21, 2018 at 08:34:50AM +0530, Subhadip Ghosh wrote: >> Hi, >> >> I am using Debian and the recently I learned that a standard Debian >> installation allows all 3 types of traffics especially incoming by default. > What do you mean by "all 3 types of traffics"? Incoming, Outgoing and Forward >> I know I can easily use iptables to tighten the rules but I wanted to know >> the reasons behind the choice of this default behaviour and if it makes the >> system more vulnerable? > The behavior you observe is likely because that is the best default that is > universally applicable. But does it make the system more vulnerable in any way to attacks over the network? And how will a new Debian user would know of this behaviour? I don't even see it mentioned on the Stretch Installation manual anywhere. > >> I tried searching on the Internet but did not get >> any satisfactory explanation. It will be helpful if anybody knows the >> answers to my questions or can redirect me to a helpful document. >> > Where did you search or what terms did you use? Search engines (Google and Duckduckgo). Search terms were similar to the email subject line. I also read the wiki on Debian Firewall where it says about the choice of defaults but not the reasons. Thanks, Subhadip
[toc] | [prev] | [next] | [standalone]
| From | Roberto C. Sánchez <roberto@debian.org> |
|---|---|
| Date | 2018-09-21 05:50 +0200 |
| Message-ID | <wAkC5-3lx-1@gated-at.bofh.it> |
| In reply to | #200360 |
On Fri, Sep 21, 2018 at 09:02:26AM +0530, Subhadip Ghosh wrote: > Hi Roberto, > > On Friday 21 September 2018 08:51 AM, Roberto C. Sánchez wrote: > > On Fri, Sep 21, 2018 at 08:34:50AM +0530, Subhadip Ghosh wrote: > > > Hi, > > > > > > I am using Debian and the recently I learned that a standard Debian > > > installation allows all 3 types of traffics especially incoming by default. > > What do you mean by "all 3 types of traffics"? > Incoming, Outgoing and Forward I see. Blocking incoming and forwarded traffic would probably not be surprising to many people. However, blocking outgoint traffic would be exceedingly confusing to many people. > > > I know I can easily use iptables to tighten the rules but I wanted to know > > > the reasons behind the choice of this default behaviour and if it makes the > > > system more vulnerable? > > The behavior you observe is likely because that is the best default that is > > universally applicable. > But does it make the system more vulnerable in any way to attacks over the > network? And how will a new Debian user would know of this behaviour? I > don't even see it mentioned on the Stretch Installation manual anywhere. I see. Perhaps the Debian Administrator's Handbook, Chapter 14 is what you are looking for: https://www.debian.org/doc/manuals/debian-handbook/security.en.html While there is possibly an argument that not configuring a firewall by default introduces some vulnerability, it is equally valid to argue that there are no sensible default firewall policies that can be put into place without a defined threat model. I suspect that the vast majority of people deploying systems are doing so behind some sort of device that provides border security to the local network (e.g., router/firewall/NAT/etc.). So, if the default threat model is "a relatively trusted network with adequate border security" then the current default is appropriate. Those who deploy systems directly to a location where they are in immediate contact with the public Internet should already understand the ramifications of that decision and tailor their installation process accordingly. Regards, -Roberto -- Roberto C. Sánchez
[toc] | [prev] | [next] | [standalone]
| From | deloptes <deloptes@gmail.com> |
|---|---|
| Date | 2018-09-21 07:10 +0200 |
| Message-ID | <wAlRw-4h3-9@gated-at.bofh.it> |
| In reply to | #200361 |
Roberto C. Sánchez wrote: > I suspect that the vast majority of people deploying systems are doing > so behind some sort of device that provides border security to the local > network (e.g., router/firewall/NAT/etc.). So, if the default threat > model is "a relatively trusted network with adequate border security" > then the current default is appropriate. I agree completely. The default policy in RedHat or CentOS is annoying. I have to disable those every time after installation.
[toc] | [prev] | [next] | [standalone]
| From | Subhadip Ghosh <subhadip.sky@gmail.com> |
|---|---|
| Date | 2018-09-21 19:40 +0200 |
| Message-ID | <wAxzj-2ya-9@gated-at.bofh.it> |
| In reply to | #200361 |
Hi Roberto, > Blocking incoming and forwarded traffic would probably not be surprising > to many people. However, blocking outgoint traffic would be exceedingly > confusing to many people. Yep. Totally agreed. > https://www.debian.org/doc/manuals/debian-handbook/security.en.html Thanks. > While there is possibly an argument that not configuring a firewall by > default introduces some vulnerability, it is equally valid to argue that > there are no sensible default firewall policies that can be put into > place without a defined threat model. > > I suspect that the vast majority of people deploying systems are doing > so behind some sort of device that provides border security to the local > network (e.g., router/firewall/NAT/etc.). So, if the default threat > model is "a relatively trusted network with adequate border security" > then the current default is appropriate. > > Those who deploy systems directly to a location where they are in > immediate contact with the public Internet should already understand the > ramifications of that decision and tailor their installation process > accordingly. I don't disagree. Thanks, Subhadip
[toc] | [prev] | [next] | [standalone]
| From | Dan Ritter <dsr@randomstring.org> |
|---|---|
| Date | 2018-09-21 19:10 +0200 |
| Message-ID | <wAx6h-2p2-1@gated-at.bofh.it> |
| In reply to | #200360 |
On Fri, Sep 21, 2018 at 09:02:26AM +0530, Subhadip Ghosh wrote:
> Hi Roberto,
>
> On Friday 21 September 2018 08:51 AM, Roberto C. Sánchez wrote:
> > On Fri, Sep 21, 2018 at 08:34:50AM +0530, Subhadip Ghosh wrote:
> > > Hi,
> > >
> > > I am using Debian and the recently I learned that a standard Debian
> > > installation allows all 3 types of traffics especially incoming by default.
> > What do you mean by "all 3 types of traffics"?
> Incoming, Outgoing and Forward
> > > I know I can easily use iptables to tighten the rules but I wanted to know
> > > the reasons behind the choice of this default behaviour and if it makes the
> > > system more vulnerable?
> > The behavior you observe is likely because that is the best default that is
> > universally applicable.
> But does it make the system more vulnerable in any way to attacks over the
> network? And how will a new Debian user would know of this behaviour? I
> don't even see it mentioned on the Stretch Installation manual anywhere.
> >
> > > I tried searching on the Internet but did not get
> > > any satisfactory explanation. It will be helpful if anybody knows the
> > > answers to my questions or can redirect me to a helpful document.
> > >
> > Where did you search or what terms did you use?
> Search engines (Google and Duckduckgo). Search terms were similar to the
> email subject line. I also read the wiki on Debian Firewall where it says
> about the choice of defaults but not the reasons.
The basic reason is this: it makes sense.
Let's suppose Debian installs a basic firewall by default. How
basic? Let's say:
- outbound: permit
- forward: deny
- inbound: accept NTP, DHCP, DNS, and any TCP packet which is a
response to an outbound packet
Now, what should happen when a user installs an SSH daemon?
Should it automatically change the firewall? Of course,
otherwise everyone who installs SSH would discover that it
doesn't work.
How many packages now have to have scripts written to update the
firewall?
What happens when a user installs a multi-protocol daemon like
Dovecot? Does it automatically open POP, POP/S, IMAP and IMAP/S?
All of them? None of them?
There are an infinite number of questions to be asked, all of
which can be summarized as "please read the user's mind and find
out what they want". This is particularly difficult when the
user doesn't know what they want.
Remember, Debian isn't a laptop OS. Debian isn't a desktop OS.
Debian isn't a phone OS. Debian isn't a server OS. Debian isn't
a supercomputing OS. Debian isn't an embedded device OS.
Debian is a Universal OS.
-dsr-
[toc] | [prev] | [next] | [standalone]
| From | Subhadip Ghosh <subhadip.sky@gmail.com> |
|---|---|
| Date | 2018-09-21 19:40 +0200 |
| Message-ID | <wAxzj-2ya-1@gated-at.bofh.it> |
| In reply to | #200387 |
Hi Dan, > The basic reason is this: it makes sense. > > Let's suppose Debian installs a basic firewall by default. How > basic? Let's say: > > - outbound: permit > - forward: deny > - inbound: accept NTP, DHCP, DNS, and any TCP packet which is a > response to an outbound packet > > Now, what should happen when a user installs an SSH daemon? > Should it automatically change the firewall? Of course, > otherwise everyone who installs SSH would discover that it > doesn't work. > > How many packages now have to have scripts written to update the > firewall? > > What happens when a user installs a multi-protocol daemon like > Dovecot? Does it automatically open POP, POP/S, IMAP and IMAP/S? > All of them? None of them? > > There are an infinite number of questions to be asked, all of > which can be summarized as "please read the user's mind and find > out what they want". This is particularly difficult when the > user doesn't know what they want. > > Remember, Debian isn't a laptop OS. Debian isn't a desktop OS. > Debian isn't a phone OS. Debian isn't a server OS. Debian isn't > a supercomputing OS. Debian isn't an embedded device OS. > > Debian is a Universal OS. I wouldn't say whatever you said, doesn't make sense. I wish there were an easier way to know about it when I started using the OS, something to warn me that I need to configure the firewall to suit my needs. Maybe because I came from a different OS where the defaults were stricter, my expectations about the defaults were different. Thanks, Subhadip
[toc] | [prev] | [next] | [standalone]
| From | deloptes <deloptes@gmail.com> |
|---|---|
| Date | 2018-09-21 20:00 +0200 |
| Message-ID | <wAxSG-2EA-5@gated-at.bofh.it> |
| In reply to | #200389 |
Subhadip Ghosh wrote: > something to > warn me that I need to configure the firewall to suit my needs. You mean the Windows warning "Your system is not protected"? How mature shouldone be to know what it means to use the internet? Where this message should come from? Imagine I install 450MB debian as my firewall or server - no gui, or I install debian with arbitrary desktop - who is going to do the warning. If it is the installer, what should happen next - should I install something or not and even if I install it and then I decide to use a different solution - who is going to manage it? It overcomplicates things. I personally would be also glad to have some kind of handy firewall. regards
[toc] | [prev] | [next] | [standalone]
| From | Subhadip Ghosh <subhadip.sky@gmail.com> |
|---|---|
| Date | 2018-09-21 20:10 +0200 |
| Message-ID | <wAy2l-2WV-9@gated-at.bofh.it> |
| In reply to | #200392 |
> You mean the Windows warning "Your system is not protected"? > > How mature shouldone be to know what it means to use the internet? > > Where this message should come from? The last thing I want is a Windows like warning. I expected more like a line in the Installation manual warning about the default firewall configuration. > Imagine I install 450MB debian as my firewall or server - no gui, or I > install debian with arbitrary desktop - who is going to do the warning. > If it is the installer, what should happen next - should I install something > or not and even if I install it and then I decide to use a different > solution - who is going to manage it? > > It overcomplicates things. > > I personally would be also glad to have some kind of handy firewall. There is a firewall program that comes installed by default in Debian. It's called iptables.
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2018-09-21 21:40 +0200 |
| Message-ID | <wAzrs-3Ec-3@gated-at.bofh.it> |
| In reply to | #200393 |
On Fri 21 Sep 2018 at 23:37:11 +0530, Subhadip Ghosh wrote: > > > You mean the Windows warning "Your system is not protected"? > > > > How mature shouldone be to know what it means to use the internet? > > > > Where this message should come from? > The last thing I want is a Windows like warning. I expected more like a line > in the Installation manual warning about the default firewall configuration. That's a fair enough comment. Perhaps an inquiry to -doc and/or -boot might elicit some response. -- Brian.
[toc] | [prev] | [next] | [standalone]
| From | David Wright <deblis@lionunicorn.co.uk> |
|---|---|
| Date | 2018-09-21 21:50 +0200 |
| Message-ID | <wAzB7-3Hn-1@gated-at.bofh.it> |
| In reply to | #200389 |
On Fri 21 Sep 2018 at 22:59:57 (+0530), Subhadip Ghosh wrote: > > Hi Dan, > > The basic reason is this: it makes sense. > > > > Let's suppose Debian installs a basic firewall by default. How > > basic? Let's say: > > > > - outbound: permit > > - forward: deny > > - inbound: accept NTP, DHCP, DNS, and any TCP packet which is a > > response to an outbound packet > > > > Now, what should happen when a user installs an SSH daemon? > > Should it automatically change the firewall? Of course, > > otherwise everyone who installs SSH would discover that it > > doesn't work. > > > > How many packages now have to have scripts written to update the > > firewall? > > > > What happens when a user installs a multi-protocol daemon like > > Dovecot? Does it automatically open POP, POP/S, IMAP and IMAP/S? > > All of them? None of them? > > > > There are an infinite number of questions to be asked, all of > > which can be summarized as "please read the user's mind and find > > out what they want". This is particularly difficult when the > > user doesn't know what they want. > > > > Remember, Debian isn't a laptop OS. Debian isn't a desktop OS. > > Debian isn't a phone OS. Debian isn't a server OS. Debian isn't > > a supercomputing OS. Debian isn't an embedded device OS. > > > > Debian is a Universal OS. > > I wouldn't say whatever you said, doesn't make sense. I wish there > were an easier way to know about it when I started using the OS, > something to warn me that I need to configure the firewall to suit my > needs. Maybe because I came from a different OS where the defaults > were stricter, my expectations about the defaults were different. The naive user is not going to know what to make of this warning, so it will be as useless as Proposition 65. If/when they learn what a firewall is, they should probably turn their attention firstly to their router and modem combination and their ISP (particularly if it "owns" the said devices). OTOH default packet filtering on Debian machines could lead to an explosion of support queries. That probably suits commercial providers as they can then charge for their responses. Here, it just increases the list traffic. But if you're serious, the normal way is to write a suitable paragraph and submit it as a wishlist bug against the debian-installer. Then it might be discussed by people more expert than me. Cheers, David.
[toc] | [prev] | [next] | [standalone]
| From | mick crane <mick.crane@gmail.com> |
|---|---|
| Date | 2018-09-23 01:10 +0200 |
| Message-ID | <wAZce-1Ys-3@gated-at.bofh.it> |
| In reply to | #200389 |
On 2018-09-21 18:29, Subhadip Ghosh wrote: Debian is a Universal OS. > > I wouldn't say whatever you said, doesn't make sense. I wish there > were an easier way to know about it when I started using the OS, > something to warn me that I need to configure the firewall to suit my > needs. Maybe because I came from a different OS where the defaults > were stricter, my expectations about the defaults were different. > fell foul of this years ago. installed OS, naively went on IRC while looking about at what was installed. "oh, I seem to have ports open" 20 seconds later somebody took over my account" Rapidly pulls cable and reinstalls. Some sort of a warning during installation. "there is no firewall running, You should probably set up some rules" would be helpful. mick -- Key ID 4BFEBB31
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2018-09-23 20:00 +0200 |
| Message-ID | <wBgPL-3IA-1@gated-at.bofh.it> |
| In reply to | #200459 |
On Sun 23 Sep 2018 at 00:05:58 +0100, mick crane wrote: > On 2018-09-21 18:29, Subhadip Ghosh wrote: > Debian is a Universal OS. > > > > I wouldn't say whatever you said, doesn't make sense. I wish there > > were an easier way to know about it when I started using the OS, > > something to warn me that I need to configure the firewall to suit my > > needs. Maybe because I came from a different OS where the defaults > > were stricter, my expectations about the defaults were different. > > > > fell foul of this years ago. installed OS, naively went on IRC while looking > about at what was installed. > "oh, I seem to have ports open" > 20 seconds later somebody took over my account" Tough. > Rapidly pulls cable and reinstalls. And never used IRC again. :) > Some sort of a warning during installation. > "there is no firewall running, You should probably set up some rules" > > would be helpful. The ordinary user's eyes would glaze over. The installation process is ok as it is. -- Brian.
[toc] | [prev] | [next] | [standalone]
| From | Joe <joe@jretrading.com> |
|---|---|
| Date | 2018-09-23 23:00 +0200 |
| Message-ID | <wBjDX-5n4-3@gated-at.bofh.it> |
| In reply to | #200506 |
On Sun, 23 Sep 2018 18:58:07 +0100 Brian <ad44@cityscape.co.uk> wrote: > On Sun 23 Sep 2018 at 00:05:58 +0100, mick crane wrote: > > > On 2018-09-21 18:29, Subhadip Ghosh wrote: > > Debian is a Universal OS. > > > > > > I wouldn't say whatever you said, doesn't make sense. I wish there > > > were an easier way to know about it when I started using the OS, > > > something to warn me that I need to configure the firewall to > > > suit my needs. Maybe because I came from a different OS where the > > > defaults were stricter, my expectations about the defaults were > > > different. > > > > fell foul of this years ago. installed OS, naively went on IRC > > while looking about at what was installed. > > "oh, I seem to have ports open" > > 20 seconds later somebody took over my account" > > Tough. > > > Rapidly pulls cable and reinstalls. > > And never used IRC again. :) > > > Some sort of a warning during installation. > > "there is no firewall running, You should probably set up some > > rules" > > > > would be helpful. > > The ordinary user's eyes would glaze over. The installation process is > ok as it is. > There are firewall applications which can produce fairly sensible defaults painlessly, towards which a hint might be made. If you need more control, learn iptables early, you will eventually anyway. -- Joe
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2018-09-24 00:00 +0200 |
| Message-ID | <wBkA1-5Vi-1@gated-at.bofh.it> |
| In reply to | #200517 |
On Sun 23 Sep 2018 at 21:59:38 +0100, Joe wrote: > On Sun, 23 Sep 2018 18:58:07 +0100 > Brian <ad44@cityscape.co.uk> wrote: > > > On Sun 23 Sep 2018 at 00:05:58 +0100, mick crane wrote: > > > > > On 2018-09-21 18:29, Subhadip Ghosh wrote: > > > Debian is a Universal OS. > > > > > > > > I wouldn't say whatever you said, doesn't make sense. I wish there > > > > were an easier way to know about it when I started using the OS, > > > > something to warn me that I need to configure the firewall to > > > > suit my needs. Maybe because I came from a different OS where the > > > > defaults were stricter, my expectations about the defaults were > > > > different. > > > > > > fell foul of this years ago. installed OS, naively went on IRC > > > while looking about at what was installed. > > > "oh, I seem to have ports open" > > > 20 seconds later somebody took over my account" > > > > Tough. > > > > > Rapidly pulls cable and reinstalls. > > > > And never used IRC again. :) > > > > > Some sort of a warning during installation. > > > "there is no firewall running, You should probably set up some > > > rules" > > > > > > would be helpful. > > > > The ordinary user's eyes would glaze over. The installation process is > > ok as it is. > > > > There are firewall applications which can produce fairly sensible > defaults painlessly, towards which a hint might be made. If you need > more control, learn iptables early, you will eventually anyway. Such applications exist. They have never been part of a default installation of Debian or ever mentioned. Deduce from that what you will. iptables is available. I've never needed to use it. The vast majority of users won't need it either. -- Brian.
[toc] | [prev] | [next] | [standalone]
| From | Pascal Hambourg <pascal@plouf.fr.eu.org> |
|---|---|
| Date | 2018-09-22 09:40 +0200 |
| Message-ID | <wAKGd-1MF-5@gated-at.bofh.it> |
| In reply to | #200387 |
Le 21/09/2018 à 19:09, Dan Ritter a écrit : > > Let's suppose Debian installs a basic firewall by default. How > basic? Let's say: > > - outbound: permit > - forward: deny > - inbound: accept NTP, DHCP, DNS, and any TCP packet which is a > response to an outbound packet Why should unsolicited NTP, DHCP and DNS inbound packets be allowed ? Why should only TCP inbound responses be allowed ? What about UDP-based protocols, ping replies (ICMP echo reply), ICMP error messages, and so on ?
[toc] | [prev] | [next] | [standalone]
| From | Gene Heskett <gheskett@shentel.net> |
|---|---|
| Date | 2018-09-22 11:20 +0200 |
| Message-ID | <wAMeZ-2Mf-5@gated-at.bofh.it> |
| In reply to | #200415 |
On Saturday 22 September 2018 03:34:45 Pascal Hambourg wrote: > Le 21/09/2018 à 19:09, Dan Ritter a écrit : > > Let's suppose Debian installs a basic firewall by default. How > > basic? Let's say: > > > > - outbound: permit > > - forward: deny > > - inbound: accept NTP, DHCP, DNS, and any TCP packet which is a > > response to an outbound packet > > Why should unsolicited NTP, DHCP and DNS inbound packets be allowed ? > Because you can set an ntp corrected machine as a broadcaster, therefore reducing the load on the tier 2 servers such as debian maintains by using their pool.debian.org or the tier 1 servers at pool.ntp.org. That way I have 7 machines here, all synchronized to the first or 2nd tier of time servers on the planet. This machine is a slave to my router, it broadcasts to the other 6 machines, so I have all synched and well within a millisecond. One could use his main machine that way. Some routers can also serve as servers, dd-wrt installed on a Buffalo NetFinity can also do this. So it has become the broadcaster to my all natted home network. I finally did that conversion last spring, cutting out the 2nd npt request traffic. > Why should only TCP inbound responses be allowed ? What about > UDP-based protocols, ping replies (ICMP echo reply), ICMP error > messages, and so on ? I probably should have iptables running on all my machines, but in 15 years, only one person as gotten thru dd-wrt to this machine, and I had to give him the login credentials, I needed help configuring something, on a long since replaced fedora install. So there is no firewall enabled on any of the machines here. And because everytime Andrew Triggel sits down at a keyboard cifs dies, same for NFS, I've found that ssh and sshfs as local networking tools Just Work, so I don't have to putz near as much with access maintenance. No NFS shares, no sammba/cifs shares. And life is so much simpler. Computers should work for you, not the other way around, forcing you to remember how to push 17 buttons just to answer an incoming email. This message only required 1 button click and all this typing. Everything else is handled automatically by scripts. -- Cheers, Gene Heskett -- "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Genes Web page <http://geneslinuxbox.net:6309/gene>
[toc] | [prev] | [next] | [standalone]
| From | Pascal Hambourg <pascal@plouf.fr.eu.org> |
|---|---|
| Date | 2018-09-22 13:00 +0200 |
| Message-ID | <wANNL-3x4-1@gated-at.bofh.it> |
| In reply to | #200422 |
Le 22/09/2018 à 11:12, Gene Heskett a écrit : > On Saturday 22 September 2018 03:34:45 Pascal Hambourg wrote: > >> Le 21/09/2018 à 19:09, Dan Ritter a écrit : >>> Let's suppose Debian installs a basic firewall by default. How >>> basic? Let's say: >>> >>> - outbound: permit >>> - forward: deny >>> - inbound: accept NTP, DHCP, DNS, and any TCP packet which is a >>> response to an outbound packet >> >> Why should unsolicited NTP, DHCP and DNS inbound packets be allowed ? >> > Because you can set an ntp corrected machine as a broadcaster Does the client NTP daemon accepts inbound broadcast messages from any source by default ? If so, this seems quite insecure to me and the firewall should not allow this by default. If not, it requires some configuration, and allowing inbound NTP broadcast from the broadcaster address only should be part of this configuration. >> Why should only TCP inbound responses be allowed ? What about >> UDP-based protocols, ping replies (ICMP echo reply), ICMP error >> messages, and so on ? > > I probably should have iptables running on all my machines, but in 15 > years, only one person as gotten thru dd-wrt to this machine, and I had > to give him the login credentials, I needed help configuring something, > on a long since replaced fedora install. So there is no firewall > enabled on any of the machines here. And because everytime Andrew > Triggel sits down at a keyboard cifs dies, same for NFS, I've found that > ssh and sshfs as local networking tools Just Work, so I don't have to > putz near as much with access maintenance. No NFS shares, no sammba/cifs > shares. And life is so much simpler. > > Computers should work for you, not the other way around, forcing you to > remember how to push 17 buttons just to answer an incoming email. This > message only required 1 button click and all this typing. Everything > else is handled automatically by scripts. I do not see how all this replies to my question : Why should only TCP inbound responses be allowed ? What about UDP-based protocols, ping replies (ICMP echo reply), ICMP error messages, and so on ?
[toc] | [prev] | [next] | [standalone]
| From | Dan Ritter <dsr@randomstring.org> |
|---|---|
| Date | 2018-09-22 13:40 +0200 |
| Message-ID | <wAOqt-3Yr-9@gated-at.bofh.it> |
| In reply to | #200426 |
On Sat, Sep 22, 2018 at 12:55:24PM +0200, Pascal Hambourg wrote: > I do not see how all this replies to my question : > > Why should only TCP inbound responses be allowed ? What about UDP-based > protocols, ping replies (ICMP echo reply), ICMP error messages, and so on ? Given that my entire point was that no firewall policy other than "configure it yourself" will work, it's really you missing the point to expect me to describe a complete firewall policy tuned to your desires. -dsr-
[toc] | [prev] | [next] | [standalone]
Page 1 of 5 [1] 2 3 4 5 Next page →
Back to top | Article view | linux.debian.user
csiph-web