3 ms·
This vulnerability seems to be pretty hard to actually exploit, but for those of you who are running Ubuntu on their desktops, consider enabling a firewall, whi
by smokel 2y ago
This vulnerability seems to be pretty hard to actually exploit, but for those of you who are running Ubuntu on their desktops, consider enabling a firewall, which is as easy as:
sudo ufw enable
Beats me why this is not the default.
- hypeatei 2y agoAlso this: > sudo ufw deny 631 > sudo ufw reload
- remram 2y agoreload is unnecessary if you make changes via the command line.
- acdha 2y agoMaybe, but it’s good practice to verify that your reload is clean when you are actively working on it.
- remram 2y agoIf by "working on it" you mean "changing configuration files"... "Good practice" is never an argument btw. "It's good practice" means arguments exist, it is not an argument.
- acdha 2y agoBeing pedantic is rarely helpful, especially when the drive to correct people means you rush and neglect to be correct, as you did each time. There’s nothing magic about configuration files. Any time you are making changes which could impact a system’s ability to restart, you want to test them when you’re ready to fix a problem rather than waiting for the next security patch, power outage, etc. It’s more likely to make mistakes when editing config files by hand but it’s not the only way, and since it’s so very easy to check the argument against doing so is very weak - being confident you haven’t made a mistake is worth the second it takes. “Good practice” is an argument, but it’s at a different level. Any field has lessons drawn from collective experience, and while those are never perfect and change over time they are a convenient shorthand for things which usually aren’t worth spelling out in detail every time. We say it’s good practice to have backups because most people only need the reminder, not a three page discussion.
- remram 2y agoYou're free to restart anything you want, of course. Reboot the whole machine every time you change anything, that way you'll be sure. I am not stopping you, and in some cases it can be useful to make absolutely certain. I only pointed out that "ufw reload" is not necessary to make "ufw allow/deny/delete" take effect. Multiple people might not have known that, judging from the upvotes I got. And now I find I have to justify myself. Is that being "pedantic"? Am I the one "rushing"? I don't see a reason why reload should be "good practice". If ufw or your config is buggy, it is very possible for the rules not to apply at next boot, when iptables is reset. If this is critical, reboot and do a test connection.
- usr1106 2y agodeny 631 is not needed. The default is deny as soon as the firewall is enabled. Tested on Ubuntu 22.04.
- remram 2y agoYou are right of course, but the default policy can be changed using "ufw default allow incoming", making "deny" necessary. You might do it on a laptop/workstation (in a network firewalled from the internet), though it doesn't sound like a great idea to me.
- hypeatei 2y agoI prefer explicitness when it comes to configuring firewalls. Both for documentation and to guard against defaults changing underneath you.
- tsimionescu 2y agoJust enabling the firewall is not enough. The Ubuntu distros explicitly wanted to allow the vector for this vulnerability: the whole purpose of having cups-browsed installed is to allow LAN printers to advertise themselves to your system.