Ytdyklly

We have various Ubuntu appliances deployed throughout the US. We've run into some situations recently where we are getting requests for IP whitelists (instead of FQDN whitelists) of the repos that we need to run updates (we're trying to avoid hosting our own as that has its own challenges).

Taking a look at what the servers would reach now, I see the following:

root@VamLab-Server:/etc# dig +short $(grep -Pho '^s*[^#].*?https?://K[^/]+' /etc/apt/sources.list /etc/apt/sources.list.d/*.list | sort -u) | sort -u

91.189.88.149

91.189.88.152

91.189.88.161

91.189.88.162

91.189.91.23 <--both security and archive

91.189.91.26 <--both security and archive



root@VamLab-Server:/etc# cat /etc/apt/sources.list | grep -v "#"

deb http://us.archive.ubuntu.com/ubuntu/ xenial main restricted

deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main restricted

deb http://us.archive.ubuntu.com/ubuntu/ xenial universe

deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates universe

deb http://us.archive.ubuntu.com/ubuntu/ xenial multiverse

deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates multiverse

deb http://us.archive.ubuntu.com/ubuntu/ xenial-backports main restricted universe multiverse

deb http://security.ubuntu.com/ubuntu xenial-security main restricted

deb http://security.ubuntu.com/ubuntu xenial-security universe

deb http://security.ubuntu.com/ubuntu xenial-security multiverse

Is there a way to get the formal list of statics from Ubuntu? I know the recommendation is for FQDN whitelisting, but some of our customers either lack the hardware or capability to add the required FQDN rules. Sometimes it can take weeks for our customers to add firewall rules since it requires them going through their IP departments, so we're trying to see if can get ahead of those steps with customer frustration and tech support time for each.

Thanks in advance!

The easiest way to manage this is probably to configure a private mirror, or even a private proxy server for your sites to use.

Public mirrors may change IP at no notice, not giving you access to updates. Running your own mirror, or proxy, allows you to whitelist at the URL level on that proxy, and allow the IP of that proxy trough firewalls.

You may want to look at apt-cache to run a caching repository, or you may run a classic proxy, such as Squid, and only allow e.g. *.ubuntu.com as destination.

You will probably spend less time on this approach than trying to maintain a reliable list of IPs.

While you may be able to piece together a current list of IP's, Canonical or other parties running the mirrors will probably give you zero warranty that they won't change IPs as they see fit. That's after all the reason for having DNS; Flexibility.

That's potentially weeks without updates. In my world, that's an clearly unacceptable position to be in. Either run your own, white listed, proxy, or private mirror.