4 ms·
There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide. Still the only OS I'd trust ho
by bitwize 2y ago
There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide. Still the only OS I'd trust hooking directly up to the internet with a web server or something, without a firewall of some sort in between.
I got into OpenBSD again when I bought a new, cheap potato to play with -- an HP thin client PC I scored off eBay for $25. The super-lightweight candidate operating systems I tried for it -- AROS and Haiku -- both struggled with its eMMC controller and couldn't even find a volume to install to; the same, oddly, was true of NetBSD. OpenBSD found it just fine.
- cess11 2y agoWhy would you turn off the firewall?
- BSDobelix 2y agoBecause you just have services that are already "internet hardened" running?
- saagarjha 2y agoSounds like a poor reason to turn off your firewall
- WesolyKubeczek 2y agoCan't see a reason to close ports with firewall on which there is nothing listening anyway. The best defence, IMO, is not to have the thing if you don't need the thing. Having to remember about it all the time sometimes prevents the work from getting done.
- adrian_b 2y agoYou may want to not send back the "unreachable port" ICMP messages that are the default behavior for ports on which there is nothing listening. The traditional configuration for a server or router is to block in the firewall all the unused ports, which means that ICMP responses will not be sent back, with the exception of the range of ports that are normally used by the "traceroute" utility. Unfortunately, there are also stupid people who block in the firewall even the traceroute ports, which makes more difficult the diagnosing of any network problem.
- mrweasel 2y agoWhat would the firewall do in this case exactly? It's just a webserver, so you'd normally allow all http/https traffic through anyway.
- DEADMINCE 2y ago> There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide It's nothing to do with OpenBSD though, is it. I swear it's ingrained to people to just unconsciously compliment OpenBSD's security and spread the myth. Put fail2ban on a public facing webserver or setup any kind of honeypot and enjoy the exact same thing.