What firewall do I need to install under Linux? - they ask

This has been asked by a friend of mine some time ago. In short, you have the needed links over here: http://en.wikipedia.org/wiki/Netfilter

As it was a phone call, I started the conversation by telling him that you don't necessarily need a firewall, or at least it's not a problem if you will only have time to configure the system in a week or so. "Really?" - he gasped. In short, I told him, you can trust an Ubuntu system (okay, not the best example of this but that's what he had at hand :->) much more than what you had before. You see he was accustomed to seeing malware taking over his w. system in a matter of minutes and having a need for re-installation many times despite taking precaution (firewall, virus scanners, etc.) _and_ having an I.T. background.

He asked me how this could be true. I said it's simple. There exist many layers of protection that improve your security.

  • You can install software packages that are signed by a trusted third party (the distribution vendor).
  • Many have already installed and tested the same package before you. Some distributions offer staging areas which buffer packages for months (or even years) before releasing them into the stable pool.
  • Everyone is free to download and try the same, as packages are not hidden: they are browseable and searchable from your package manager.
  • The program source code of practically everything is available for you to review. And it's not only you who could do that, but also anyone else interested. So practically every bug or threat is "shallow" to so many eyes, especially if you factor in the buffer period.
  • Most software packages are licensed under a developer-friendly copyleft license that encourages collaboration. This attracts more programmers to both enhance and review the software.


As a last note on this topic, I have to caution that most any practical software could have vulnerabilities that will only surface after widespread deployment. This can be especially aggravated by programming language choice. So please opt for layered and redundant security if you do plan to run any remotely mission-critical projects and never blindly trust anything.

"The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts." - Gene Spafford, leading computer security expert and prof. of CS

Comments

Post a Comment

Popular posts from this blog

Hidden TFTP of TP-Link routers

I did some more investigation after the positive results with the TL-WR740Nv4  (click the link to get introduced to the way of recovery). Most users report that devices and firmware updates released after a point in time usually have this mode enabled. If a firmware update is available from the vendor for your device, it's a good idea to apply that update before installing OpenWRT or dd-wrt UNLESS you own something for which upgrading will ensure incompatible with OpenWrt, like a TL-WR730N , and possible some other models (please report). Note that some old models have newer updates in different languages, those may also be worth a try ( TODO : compatibility?). Also remember that later on, tftp recovery will need a type of firmware image without a boot loader, so strip it with dd if yours has it ( grep U-Boot , or check the filename). Positive reported claims so far (personal results highlighted): TL-WDR4300 router 192.168.0.86 server 192.168.0.66 query wdr4300v1_tp_...
Read more

Tftp secret of TL-WR740N uncovered

I've found out that even this particular entry level router supports anti-bricking, so there's no need for soldering, unless of course you are modding. The method I used is the following: Set up a tftp server  on your PC and verify if it works correctly (configuration, permissions, firewalls, etc.) Rename your target firmware to wr740v4_tp_recovery.bin and copy it to your base folder (by default /tftpboot). I tested with openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin r43602. Set up the following static IP for your PC: 192.168.0.66 /255.255.255.0. If you're not sure about the firmware name on a different model, start a packet sniffer on your PC ( tcpdump -i eth0 -n -l ) and look for the name in the RRQ message. Preferably disconnect WAN from the router Connect the PC to a LAN port Power off the router Press and hold the reset button Power on the router After the leftmost (power) LED and the rightmost (padlock) LED turn on alone in a few seconds, release...
Read more

When both Google *and* AppStatus is down

Here is a link where you could theoretically monitor Google outages: https://www.google.com/appsstatus#hl=en&v=status I had a problem with Google services just recently. However, as I wanted to verify whether the problem is on my side, this monitoring site was down as well. At the same time, the third party reports on alternative sites started to grow: http://outage.report/google http://downdetector.com/status/google http://aussieoutages.com/status/google This highlights why we should not put all our eggs into the same basket.
Read more