5 ms·
At the same time, it's considered poor practise to give servers open internet access. The only outgoing connections that should be allowed are to update servers
by gargravarr 9y ago
At the same time, it's considered poor practise to give servers open internet access. The only outgoing connections that should be allowed are to update servers. I'd second disabling this 'feature' on a server - it seems very unnecessary to get a MOTD from the internet in the first place, let alone if there's going to be advertising in it.
- dingaling 9y agoAnd updates are ideally pulled from a local cache so that only one server in the DMZ needs to connect to Ubuntu's server. It's disappointing that in 2017 no Linux vendor ships with a default-denial Internet firewall configuration but I suppose stories like this explain why.
- cyphar 9y ago> It's disappointing that in 2017 no Linux vendor ships with a default-denial Internet firewall configuration but I suppose stories like this explain why. I don't believe that's accurate. On openSUSE and SLE you have SuSEFirewall2 which has such a configuration (from memory) and I would be surprised if RHEL doesn't have such a configuration.