2 ms·
I‘d argue that not allowing your servers to make outgoing calls to non whitelisted targets is very basic security.
by Traubenfuchs 5y ago
I‘d argue that not allowing your servers to make outgoing calls to non whitelisted targets is very basic security.
- varjag 5y agoAre we still talking about the bug that relies on poorly chosen defaults?
- vbezhenar 5y agoNo, it's not. I can easily configure open ports using firewall-cmd. That is basic security. And there's no dedicated options to configure outgoing calls, there's no sane defaults to start with (I have no idea which targets should be whitelisted: ntp? update servers? anything else?), there's no system-wide integration, like my dnf can choose different mirror every time it runs. Of course it makes sense to configure outbound white list, but there's no infrastructure in RHEL or Ubuntu and nobody's going to bother with custom scripts for that.
- formerly_proven 5y agoDo you disable DNS on your servers as well or use a restricted internal-only resolver?