4 ms·

Well since we're on the topic of hardening Linux, there are people who do this with UFW[0]: sudo ufw deny out to any port 80 sudo ufw deny out to any p

Well since we're on the topic of hardening Linux, there are people who do this with UFW[0]: sudo ufw deny out to any port 80 sudo ufw deny out to any port 53 [0] https://help.ubuntu.com/community/UFW https://help.ubuntu.com/community/UFW This ensures no plaintext http can be sniffed, nor plaintext DNS queries. Then you can just configure DoH in your browser to get DNS functionality back, (in encrypted form usually over port 443). Doing that depends on your threat model though.

AnonC 6y ago
This reply doesn’t match your comment on time servers tracking you by IP address. Even with encrypted DNS, your DNS servers can track you the same way your time servers can. I don’t understand your points clearly.
- diablo1 6y ago
  Sorry I diverged a bit. You're right: DoH servers can still see when a box is online and possible keep logs/timestamps of requests. I would trust a DoH server more than a standard DNS server simply because it would be catastrophic for a DoH server's reputation if they were found to be handing over logs to third parties. Cloudflare keeps logs for 24 hours then deletes: but there's still that time window of a day to worry about :/ BTW: You can nuke NTP requests by doing: sudo ufw deny out to any port 123
  - viraptor 6y ago
    What is it that your worried about there? And how is it different from likely sending the same information over in SNI a moment later?
    - iso1631 6y ago
      Sounds like he doesn't trust his NTP provider and doesn't want his IP address being sent to the NTP provider, because he wasnt to pretend his IP address is not online. But he does trust cloudflare for his DNS requests. Cloudflare run NTP, so just use their server. The only threat I can see is if someone intercepts his NTP traffic, but they could intercept the DNS traffic too and see his SYNs (and indeed pass them on with you not even noticing) His concern seems to be more about the IP leaking rather than the NTP result being incorrect, however in the latter case then yes, NTP isn't signed, so it's possible for someone to skew your clock by a few seconds if they were to intercept your traffic to all your NTP servers.
Fnoord 6y ago
> This ensures no plaintext http can be sniffed It does not. It blocks all outgoing connections to TCP/UDP 53 and 80. There's no such thing as port 80 UDP HTTP traffic (there is QUIC, which uses TLS by default; your rules would block it by default), and HTTP traffic can be received over a different port than 80 TCP. Your example of NTP is also wrong, as it uses 123 UDP; not TCP. Furthermore, if someone were to skew the clock too much, your average NTP client does not accept such. This stops only very archaic malware. I guess a poor man's NIDS.

AnonC 6y ago

This reply doesn’t match your comment on time servers tracking you by IP address. Even with encrypted DNS, your DNS servers can track you the same way your time servers can. I don’t understand your points clearly.

diablo1 6y ago
Sorry I diverged a bit. You're right: DoH servers can still see when a box is online and possible keep logs/timestamps of requests. I would trust a DoH server more than a standard DNS server simply because it would be catastrophic for a DoH server's reputation if they were found to be handing over logs to third parties. Cloudflare keeps logs for 24 hours then deletes: but there's still that time window of a day to worry about :/ BTW: You can nuke NTP requests by doing: sudo ufw deny out to any port 123
- viraptor 6y ago
  What is it that your worried about there? And how is it different from likely sending the same information over in SNI a moment later?
  - iso1631 6y ago
    Sounds like he doesn't trust his NTP provider and doesn't want his IP address being sent to the NTP provider, because he wasnt to pretend his IP address is not online. But he does trust cloudflare for his DNS requests. Cloudflare run NTP, so just use their server. The only threat I can see is if someone intercepts his NTP traffic, but they could intercept the DNS traffic too and see his SYNs (and indeed pass them on with you not even noticing) His concern seems to be more about the IP leaking rather than the NTP result being incorrect, however in the latter case then yes, NTP isn't signed, so it's possible for someone to skew your clock by a few seconds if they were to intercept your traffic to all your NTP servers.

Fnoord 6y ago

> This ensures no plaintext http can be sniffed It does not. It blocks all outgoing connections to TCP/UDP 53 and 80. There's no such thing as port 80 UDP HTTP traffic (there is QUIC, which uses TLS by default; your rules would block it by default), and HTTP traffic can be received over a different port than 80 TCP. Your example of NTP is also wrong, as it uses 123 UDP; not TCP. Furthermore, if someone were to skew the clock too much, your average NTP client does not accept such. This stops only very archaic malware. I guess a poor man's NIDS.