3 ms·

I sometimes do a port scan when I am in a foreign network. What I find interesting is that people generally seem to not know that 0.0.0.0 means "all interfaces

I sometimes do a port scan when I am in a foreign network. What I find interesting is that people generally seem to not know that 0.0.0.0 means "all interfaces" and have a lot of stuff running and accessible from the network. I've seen developers running their live reload server, different software (i.e. syncthing), webservers, even databases (someone running postgres on their laptop)! So, I've long thought that this is the part that actually confuses people and it even happens to otherwise technologically competent people. I also have often run into software where configuring the default listen address and port seemed to be way harder than it should, sometimes even requiring changes in the source code. So, I really think we need to start shipping some kind of client side firewall with a good UX by default (something like little snitch?).

TheDong 2y ago
I think one of the culprits of this bad default is docker containers. Since docker by default runs your code in a separate network namespace, in that context '127.0.0.1' really means "accessible inside the container, effectively nowhere", and '0.0.0.0' means "accessible only on the local machine" (except that's not actually true, check out this open issue lol https://github.com/moby/moby/issues/22054 https://github.com/moby/moby/issues/22054 ) I think that's one reason for some software's default of 0.0.0.0 - people are cargo-culting from stuff that runs in docker and/or people want their stuff to run in docker and work by default. This is only going to get worse as snap and flatpack become more common, since they have the same property.
- yjftsjthsd-h 2y ago
  > and '0.0.0.0' means "accessible only on the local machine" I don't think that right? It just means "is available to be mapped out of the container", but you still have to use -p or such for it to do anything
  - TheDong 2y ago
    You don't have to use -p with docker's default settings. $ docker run --rm --name listen busybox sh -c 'echo hi | nc -l -p 8000' # in another terminal $ docker inspect listen -f '{{ .NetworkSettings.IPAddress }}' 172.17.0.3 $ nc 172.17.0.3 8000 < /dev/null hi Works just fine for accessing it on your local machine. The -p flag is meant to "publish" a port so it's available remotely, from outside of your machine (i.e. to serve nginx to the public internet on a webserver with '-p 80:80' or whatever).
- mardifoufs 2y ago
  I think that the decision to use 0.0.0.0 in this case predates docker by a lot? Which to me indicates that docker used it because it was already a widespread (bad) default.
deleted 2y ago
[deleted]
ho_schi 2y ago
> So, I really think we need to start shipping some kind of client side firewall with a good UX by default (something like little snitch?). This is not a solution but makes it worse. Adding more vulnerable code widens the attack surface. The history of so called security software (aka snakeoil) has shown that it doesn’t protects but causes more harm. A Linux system shall show with “# ss -lpn” [1] only ports and process which are known and reachable. It easy to use and that the functions people want - knowing who is doing what. And that’s the path Linux and BSD have taken successfully in the past. Firewalls are a valid way for administrating networks itself. And while firewalls come lean and integrated on Linux, they should be used carefully. I think system-monitor tools should show open sockets and ports, like they show processes itself, in a list. [1] https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems... -> The author use the old netstat. And recommends to just turn the service off. That ensures that CUPS doesn’t make other mistakes. A thing a firewall will not do. PS: At least the Wiki of Archlinux recommends for quite some time not to install `cups-browsed` because it isn't usually need for printer discovery (IPP-Everywhere/AirPrint). At least since December 2022.
- sureglymop 2y ago
  Of course you can use netstat and ss or iptstate and of course I use these. I don't even have cups installed. I'm not talking about a user who has full control and awareness over their system already. What I'm proposing is a backwards compatible "sane default" for people who may not understand. They should get a pop up which has them confirm that the service they are starting will be open to the network they are currently in. macOS has pop ups like this for many things and it seems to mostly work, it shouldn't be that hard. I don't fully understand your point about firewalls being a valid way for administrating networks themselves (only). Linux ships with netfilter by default, nothing stands in the way of better defaults.
  - ho_schi 2y ago
    Thanks for your response. Desktop Linux ships with sane defaults, other then Windows. Most of us will not have cups-browsed installed. The notifications/permissions you mention are good proposal! Actually we want permissions and it happens already with Flatpak. And the operating-system should even ask for it outside of Flatpak. It doesn’t need a Firewall and therefore creating wrong[1] (i.e. DROP) responses. What system-monitors still lack is showing network connections like they show processes. The should all come with a tab which displays something like ss -tulpen. * Less code, less issues * Overview about what is actually used. * Permissions prevent undesired changes to this state. We don’t want to block a dangerous application with a firewall. We want to turn it off. Update it or remove it? I want to be a step ahead and keep the port closed. So I desire correct network responses, minimum code acting to reduce error probability. That is already the case. But I want more, permissions and overview of current state for all kinds of users. Not the case, ss is and netstat are good but for professional users and even for professional not the best. The difference in the firewalls in networks is, that admins care about a network, cannot control all systems, lack historical overview and (sadly) know that various network services aren’t save. Then, use Firewall. Maybe it is just tape around a problem but it is intended for that problem. PS: A nice article on Ubuntuusers (German) explains why Ubuntu doesn’t use a Firewall despite Netfilter is integrated: https://wiki.ubuntuusers.de/Personal_Firewalls/ https://wiki.ubuntuusers.de/Personal_Firewalls/ The background is that Windows users keep asking again and again why Ubuntu ships without a Firewall. Linux ships with one but it is not supposed to be used as „Desktop Firewall“. The Chaos Computer Club finally made fun of commercially available Desktop Firewalls with a lot of stupid extra code[2] (Don’t compare them to Netfilter!) twenty years ago: https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewalls/ https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewal... Fake message from DNS1. Fake message from DNS2. The Desktop Firewall removes Windows from network because it blocks now the real DNS. It is old but even today the same things happen again and again. [1] Bad. This is not what we want in a proper network. [2] It is not a mere firewall. It is not integrated into the system like Netfilter. It just a lot of extra code and tries to be smart. Which fails.
Aachen 2y ago
I think people do know, but don't care much on internal networks and also don't check in netstat what's actually exposed after installing either the base OS or additional system packages Host firewalls like ferm or ufw also make it easy to ignore these port bindings because it'll be blocked anyway. Whether that's the right mindset ("just bolt something else on"), idk, but that's the current practice
rcxdude 2y ago
A sensible (and reasonably common, but sadly not universal) default is to listen on localhost only, and require configuration to listen on all interfaces (or a specific non-local one)

TheDong 2y ago

I think one of the culprits of this bad default is docker containers. Since docker by default runs your code in a separate network namespace, in that context '127.0.0.1' really means "accessible inside the container, effectively nowhere", and '0.0.0.0' means "accessible only on the local machine" (except that's not actually true, check out this open issue lol https://github.com/moby/moby/issues/22054 https://github.com/moby/moby/issues/22054 ) I think that's one reason for some software's default of 0.0.0.0 - people are cargo-culting from stuff that runs in docker and/or people want their stuff to run in docker and work by default. This is only going to get worse as snap and flatpack become more common, since they have the same property.

yjftsjthsd-h 2y ago
> and '0.0.0.0' means "accessible only on the local machine" I don't think that right? It just means "is available to be mapped out of the container", but you still have to use -p or such for it to do anything
- TheDong 2y ago
  You don't have to use -p with docker's default settings. $ docker run --rm --name listen busybox sh -c 'echo hi | nc -l -p 8000' # in another terminal $ docker inspect listen -f '{{ .NetworkSettings.IPAddress }}' 172.17.0.3 $ nc 172.17.0.3 8000 < /dev/null hi Works just fine for accessing it on your local machine. The -p flag is meant to "publish" a port so it's available remotely, from outside of your machine (i.e. to serve nginx to the public internet on a webserver with '-p 80:80' or whatever).
mardifoufs 2y ago
I think that the decision to use 0.0.0.0 in this case predates docker by a lot? Which to me indicates that docker used it because it was already a widespread (bad) default.

deleted 2y ago

[deleted]

ho_schi 2y ago

> So, I really think we need to start shipping some kind of client side firewall with a good UX by default (something like little snitch?). This is not a solution but makes it worse. Adding more vulnerable code widens the attack surface. The history of so called security software (aka snakeoil) has shown that it doesn’t protects but causes more harm. A Linux system shall show with “# ss -lpn” [1] only ports and process which are known and reachable. It easy to use and that the functions people want - knowing who is doing what. And that’s the path Linux and BSD have taken successfully in the past. Firewalls are a valid way for administrating networks itself. And while firewalls come lean and integrated on Linux, they should be used carefully. I think system-monitor tools should show open sockets and ports, like they show processes itself, in a list. [1] https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems... -> The author use the old netstat. And recommends to just turn the service off. That ensures that CUPS doesn’t make other mistakes. A thing a firewall will not do. PS: At least the Wiki of Archlinux recommends for quite some time not to install `cups-browsed` because it isn't usually need for printer discovery (IPP-Everywhere/AirPrint). At least since December 2022.

sureglymop 2y ago
Of course you can use netstat and ss or iptstate and of course I use these. I don't even have cups installed. I'm not talking about a user who has full control and awareness over their system already. What I'm proposing is a backwards compatible "sane default" for people who may not understand. They should get a pop up which has them confirm that the service they are starting will be open to the network they are currently in. macOS has pop ups like this for many things and it seems to mostly work, it shouldn't be that hard. I don't fully understand your point about firewalls being a valid way for administrating networks themselves (only). Linux ships with netfilter by default, nothing stands in the way of better defaults.
- ho_schi 2y ago
  Thanks for your response. Desktop Linux ships with sane defaults, other then Windows. Most of us will not have cups-browsed installed. The notifications/permissions you mention are good proposal! Actually we want permissions and it happens already with Flatpak. And the operating-system should even ask for it outside of Flatpak. It doesn’t need a Firewall and therefore creating wrong[1] (i.e. DROP) responses. What system-monitors still lack is showing network connections like they show processes. The should all come with a tab which displays something like ss -tulpen. * Less code, less issues * Overview about what is actually used. * Permissions prevent undesired changes to this state. We don’t want to block a dangerous application with a firewall. We want to turn it off. Update it or remove it? I want to be a step ahead and keep the port closed. So I desire correct network responses, minimum code acting to reduce error probability. That is already the case. But I want more, permissions and overview of current state for all kinds of users. Not the case, ss is and netstat are good but for professional users and even for professional not the best. The difference in the firewalls in networks is, that admins care about a network, cannot control all systems, lack historical overview and (sadly) know that various network services aren’t save. Then, use Firewall. Maybe it is just tape around a problem but it is intended for that problem. PS: A nice article on Ubuntuusers (German) explains why Ubuntu doesn’t use a Firewall despite Netfilter is integrated: https://wiki.ubuntuusers.de/Personal_Firewalls/ https://wiki.ubuntuusers.de/Personal_Firewalls/ The background is that Windows users keep asking again and again why Ubuntu ships without a Firewall. Linux ships with one but it is not supposed to be used as „Desktop Firewall“. The Chaos Computer Club finally made fun of commercially available Desktop Firewalls with a lot of stupid extra code[2] (Don’t compare them to Netfilter!) twenty years ago: https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewalls/ https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewal... Fake message from DNS1. Fake message from DNS2. The Desktop Firewall removes Windows from network because it blocks now the real DNS. It is old but even today the same things happen again and again. [1] Bad. This is not what we want in a proper network. [2] It is not a mere firewall. It is not integrated into the system like Netfilter. It just a lot of extra code and tries to be smart. Which fails.

Aachen 2y ago

I think people do know, but don't care much on internal networks and also don't check in netstat what's actually exposed after installing either the base OS or additional system packages Host firewalls like ferm or ufw also make it easy to ignore these port bindings because it'll be blocked anyway. Whether that's the right mindset ("just bolt something else on"), idk, but that's the current practice

rcxdude 2y ago

A sensible (and reasonably common, but sadly not universal) default is to listen on localhost only, and require configuration to listen on all interfaces (or a specific non-local one)