Ytdyklly

I was wondering about Linux security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable and before used Ubuntu 12.04. If I only have a personal PC which is logged into a secured WLAN, do I need a firewall and what is already set up on the two OS mentioned above?

Easy part first: There is no firewall set up by default on Debian or Ubuntu, or most Linux distros I know of.

Do you need a firewall on Linux? Probably not, because most programs on a Linux systems that are listening for incoming connections have to be explicitly started by someone, and were installed from package repositories run by the distro. And if you're on a trusted WLAN, your computer probably has a private IP address, and is connecting to a router using NAT with a public IP address, and that router also functions as a firewall.

Reasons you might need a firewall on Linux:

• There are many programs that start a web server (or some other sort of server) so you can interface with the program from any machine. If you don't need to remotely interface with this sort of program, you could use a firewall to block all connections not coming from the computer itself.


• You don't want your computer to respond to ping. Then you would use a firewall to drop all ICMP packets. You can also have your firewall drop all packets requesting connections to closed ports without your computer responding at all. This will make you invisible to (practically all) port scans if, for example, you were using the WLAN in a shady coffee shop.


• You connect directly to the Internet with a public IP address and then join a bunch of IRC chat rooms daring the occupants to hack you.


• You are being hunted by a nation-state.

You generally do not need a firewall ever.

A firewall (more precise a packet filter) is used to filter network packages, i.e. to allow some connections and disallow others.

Connection can be ingoing or outgoing.

An ingoing connection, i.e. someone else wants to connect to your computer, is only possible, if your computer offers some service. - For a private computer you just do not offer any services and no one else is able to connect to you. All without any firewall.

For outgoing connections, i.e. you are trying to connect to some other computer, you need some software to do so. For example you use a web browser to access some remote web server. - With all the linux distributions you typically install only software from the repository of your distribution of your choice. - As this software is usually open source, you can be pretty sure, this software is only doing what it claims to do. - A firewall will usually be of no help.

The only situation where a firewall makes sense is, if you want to offer some service to some specific part of the network. In this case you have to allow connection, but filer out those connection you do not want. - But even in this case there might be easier solutions like tcpwrapper or some configuration of your service.

You can use a command like sudo netstat -tupln to list all active services. Those might be bound to 127.0.0.1 which means they are only accessible from the same host or bound to 0.0.0.0 which means they are accessible from everywhere.

It is indeed not a great idea to expose open ports when you do not need them. It increases your exposure to security vulnerabilities in the relevant software.

You do not mention a separate guest WLAN, therefore I must assume that you will in future allow other devices such as a guest's laptop, or your own phone, to connect to the same WLAN. In turn, you should assume that your guests laptops are not trustworthy.

Neither of the two OS's have any firewall set up to start with.

Ubuntu aimed to meet something called "No Open Ports" by default. In a recent version, they are failing to do so. (Bug for Rhythmbox on Ubuntu).

A standard install of Debian Wheezy listens to UDP port 111, because it runs rpcbind. (As mentioned here )

I endorse checking your current open ports using ss or netstat. I use the instructions here. The two examples above are the main ones I would expect to find.

Definitely remove rpcbind if you are not using it. rpcbind is only required for NFS2 and NFS3. (It is not required for NFS4). If you have a personal PC and you do not know what NFS is, then you are not using NFS.

You may as well also disable the DAAP plugin in Rhythmbox, if you are not using it. (It is one method to access music over the local network. So you can just disable it and see if you lose any music :-).

The disadvantage of running a firewall, is the troubleshooting required when it blocks something you do need. For example if you want to use BitTorrent, you will need to configure your firewall to allow it, otherwise you will not be able to upload (and the tit-for-tat algorithm means this can slow your download).

I suggest a two-tier approach. First learn how to check ss or netstat. Make sure you disable/remove any programs listening on the network that you do not need. Secondly, configure a firewall.

When something is not working and you need to troubleshoot it, you will be able to 1) re-check what programs are listening on the network, and 2) entirely disable the firewall in good confidence.

If your problem goes away, you will know it is a firewall problem. You can start researching what ports you need to allow (or whether there is some more tricky problem :-). And hopefully eventually configure and re-enable the firewall, so that you are covered the next time Ubuntu forget about their flagship security policy and open up a new port that you do not need :-)

The ufw firewall is available for both Debian and Ubuntu. Ubuntu created it to provide an "Uncomplicated Firewall".