5 ms·

He brings up the fact that Ubuntu doesn't enable the firewall by default. This is just a poor decision on the part of the Ubuntu maintainers. Sure it doesn't ha

by daveguy 10y ago

He brings up the fact that Ubuntu doesn't enable the firewall by default. This is just a poor decision on the part of the Ubuntu maintainers. Sure it doesn't have any ports open by default, but installing a poorly configured package (that does leave a port open) means a potential security hole that could easily be prevented. Incoming firewall should be the rule, not the exception.

dijit 10y ago
Coupled with the aptitude methodology of package management which enables/runs services on installation.
jldugger 10y ago
> installing a poorly configured package (that does leave a port open) means a potential security hole that could easily be prevented. Please share with us what magic you have that prevents human error locally, but is defeated by human error in packaging.
- daveguy 10y ago
  Well, I wouldn't call a firewall magic, but that's what it does. If a package is setup so the software listens to 0.0.0.0 (all networks) on a particular port then the firewall will prevent incoming attacks. Opening the firewall port is an extra step that requires two misconfigurations rather than one. Look up fail-safe for more reading.
GauntletWizard 10y ago
So, what you've done is add a new, non-obvious step to every installation, that will probably get worked around by the package maintainers very shortly after (they'll add a step to the installer to add a firewall rule). Your suggestion is pure human churn, and I seriously doubt that it will make it any more likely that admins will pay attention)
- daveguy 10y ago
  1) it is an obvious step for system administrators and package managers too. 2) red hat and all the other Linux systems don't seem to have a problem with this simple additional step. Ubuntu even built a wrapper to make it easy to configure iptables firewalls (ufw) -- but it isn't enabled by default. 3) Better that maintainers are adding the additional step (that will remain correct) than have each administrator do it (unless needed). That requires maintainers to at least give a passing consideration to security. Without it you set it up and yay it works! No thinking required! No thinking that you may have just left a system wide open to an untested system. I would much prefer an extra step to default insecurity. Even Microsoft gets the default firewall thing.
slavik81 10y ago
I don't think a firewall has ever protected me from anything. It's only ever caused confusing error messages, usually without actually even indicating that the firewall's the problem. That's not something I'd want to see in 'Linux for human beings'. If my mother is going to use it on her desktop, things should just work.
- daveguy 10y ago
  Windows has a firewall by default. The outgoing rule is open the incoming is closed/established. That is the same default firewall config for most Linux distros. This is also probably the default for OSX -- does your mom have trouble with her current system? Because it probably has a firewall configured. Ubuntu is one of the very few modern operating systems (distributions) that contains this easy to fix security flaw. Also, you probably wouldn't know if a firewall protected you unless you have a habit of poring over network logs. Your wifi router definitely has this default configuration which certainly does protect you on a regular basis.
  - JupiterMoon 10y ago
    Actually OSX didn't enable it by default last time I checked. And the last windows machine I touched had about 300 exceptions to the default deny incoming rule -- that the user had not opened themselves. Ubuntu would need some kind of phone-os like permission system for default deny to be both secure and be grandma friendly.
    - daveguy 10y ago
      You're right. OSX firewall is off by default -- also a poor decision. The outgoing exceptions on Windows probably because a Windows machine default deny for both incoming and outgoing which does require exceptions. Windows doesn't phone home for additional exceptions -- it asks you. The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked. Related incoming connections are allowed and outgoing connections are allowed. This would not require any difficult configuration on the part of the average home user. It seems to me that most people who are blindly defending Ubuntu's current setup do not understand how networking and firewalls work and the better options. That or they do not understand how wide open the Ubuntu defaults are. There is certainly a more secure easy to use option that Ubuntu is ignoring, but which all of the other linux distros use by default.
StevePerkins 10y ago
Is that true even for the "Server" distribution, or just the desktop spins?
- daveguy 10y ago
  This Ubuntu Server Guide would indicate that the default firewall configuration is "off" for Ubuntu Server distributions as well: https://help.ubuntu.com/lts/serverguide/firewall.html https://help.ubuntu.com/lts/serverguide/firewall.html

by daveguy 10y ago

dijit 10y ago

Coupled with the aptitude methodology of package management which enables/runs services on installation.

jldugger 10y ago

> installing a poorly configured package (that does leave a port open) means a potential security hole that could easily be prevented. Please share with us what magic you have that prevents human error locally, but is defeated by human error in packaging.

daveguy 10y ago
Well, I wouldn't call a firewall magic, but that's what it does. If a package is setup so the software listens to 0.0.0.0 (all networks) on a particular port then the firewall will prevent incoming attacks. Opening the firewall port is an extra step that requires two misconfigurations rather than one. Look up fail-safe for more reading.

GauntletWizard 10y ago

So, what you've done is add a new, non-obvious step to every installation, that will probably get worked around by the package maintainers very shortly after (they'll add a step to the installer to add a firewall rule). Your suggestion is pure human churn, and I seriously doubt that it will make it any more likely that admins will pay attention)

daveguy 10y ago
1) it is an obvious step for system administrators and package managers too. 2) red hat and all the other Linux systems don't seem to have a problem with this simple additional step. Ubuntu even built a wrapper to make it easy to configure iptables firewalls (ufw) -- but it isn't enabled by default. 3) Better that maintainers are adding the additional step (that will remain correct) than have each administrator do it (unless needed). That requires maintainers to at least give a passing consideration to security. Without it you set it up and yay it works! No thinking required! No thinking that you may have just left a system wide open to an untested system. I would much prefer an extra step to default insecurity. Even Microsoft gets the default firewall thing.

slavik81 10y ago

I don't think a firewall has ever protected me from anything. It's only ever caused confusing error messages, usually without actually even indicating that the firewall's the problem. That's not something I'd want to see in 'Linux for human beings'. If my mother is going to use it on her desktop, things should just work.

daveguy 10y ago
Windows has a firewall by default. The outgoing rule is open the incoming is closed/established. That is the same default firewall config for most Linux distros. This is also probably the default for OSX -- does your mom have trouble with her current system? Because it probably has a firewall configured. Ubuntu is one of the very few modern operating systems (distributions) that contains this easy to fix security flaw. Also, you probably wouldn't know if a firewall protected you unless you have a habit of poring over network logs. Your wifi router definitely has this default configuration which certainly does protect you on a regular basis.
- JupiterMoon 10y ago
  Actually OSX didn't enable it by default last time I checked. And the last windows machine I touched had about 300 exceptions to the default deny incoming rule -- that the user had not opened themselves. Ubuntu would need some kind of phone-os like permission system for default deny to be both secure and be grandma friendly.
  - daveguy 10y ago
    You're right. OSX firewall is off by default -- also a poor decision. The outgoing exceptions on Windows probably because a Windows machine default deny for both incoming and outgoing which does require exceptions. Windows doesn't phone home for additional exceptions -- it asks you. The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked. Related incoming connections are allowed and outgoing connections are allowed. This would not require any difficult configuration on the part of the average home user. It seems to me that most people who are blindly defending Ubuntu's current setup do not understand how networking and firewalls work and the better options. That or they do not understand how wide open the Ubuntu defaults are. There is certainly a more secure easy to use option that Ubuntu is ignoring, but which all of the other linux distros use by default.

StevePerkins 10y ago

Is that true even for the "Server" distribution, or just the desktop spins?

daveguy 10y ago
This Ubuntu Server Guide would indicate that the default firewall configuration is "off" for Ubuntu Server distributions as well: https://help.ubuntu.com/lts/serverguide/firewall.html https://help.ubuntu.com/lts/serverguide/firewall.html