Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #244215

Re: How to best whitelist CDN deb.debian.org?

Show all headers | View raw

Hi Andreas,

On Wed, Jan 19, 2022 at 08:23:15AM +0100, Andreas Ames wrote:
> I am sitting behind a firewall, in my case esp. ZScaler.  I am wondering,
> what the best way is to whitelist "deb.debian.org" for package management.

I think you may be going about things the wrong way.

I don't know what ZScaler is, but if it's some sort of firewall that
even disallows your outbound connections to HTTP sites then it seems
that you want a very secure environment.

deb.debian.org is used to give you a reasonably geographically close
mirror and to provide resilience when some backend mirror goes away.
These goals seem at odds with wanting to block outbound HTTP access
to arbitrary sites.

If you have a secure network that must not be able to connect out to
arbitrary web sites, I think you probably should be running a local
proxy or Debian mirror outside of that network, then allowing your
secure network to use that and that alone.

> Do I have to whitelist individually all mirror sites that back the CDN?  If
> so, is there an up-to-date list of the hosts backing "deb.debian.org"?

Most CDNs don't list all of their own frontend caches anywhere. I
don't know if there is some exception for Fastly's support of
deb.debian.org but even if there was I don't think I'd trust it to
stay accurate over time.

Cheers,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to best whitelist CDN deb.debian.org? Andreas Ames <andreas.0815.qwertz@gmail.com> - 2022-01-19 08:30 +0100
  Re: How to best whitelist CDN deb.debian.org? Tim Woodall <debianuser@woodall.me.uk> - 2022-01-19 10:20 +0100
  Re: How to best whitelist CDN deb.debian.org? Andy Smith <andy@strugglers.net> - 2022-01-19 15:30 +0100
    Re: How to best whitelist CDN deb.debian.org? Tim Woodall <debianuser@woodall.me.uk> - 2022-01-19 15:40 +0100
    Re: How to best whitelist CDN deb.debian.org? Andy Smith <andy@strugglers.net> - 2022-01-19 15:50 +0100

csiph-web