So about a month or two ago, in preparation for putting my server live on the internet, I configured my firewall, which was an interesting process that I want to document.
I had previously searched for "firewall" in aptitude and installed the first result, which gave me a lovely error on service init telling me that I needed to edit /etc/apf-firewall/firewall.conf, and set something-or-other to true. Obviously I generally ignored said error.
I had previously searched for "firewall" in aptitude and installed the first result, which gave me a lovely error on service init telling me that I needed to edit /etc/apf-firewall/firewall.conf, and set something-or-other to true. Obviously I generally ignored said error.
So I went looking for documentation but it turns out that Ubuntu already comes with a firewall. Therefore I got rid of apf-firewall. Then I ran
Now, I've read the six dumbest ideas in computer security. And of course, number one is default allow. Luckily, ufw was written by people smart enough to put a default deny policy in place by default:
Anyway, the last thing I have to do is figure out ping. It's supposed to work automagically, but it doesn't. So I'll look at that.
sudo ufw enable
.Now, I've read the six dumbest ideas in computer security. And of course, number one is default allow. Luckily, ufw was written by people smart enough to put a default deny policy in place by default:
So that was covered. I decided, however, to also institute a default deny policy for outgoing traffic, on the basis of "why not" - meaning that I might as well unless it became a huge issue. So far though, it's actually ok. An interesting thing that happened on my first pass, though, was that while I had port 80 open, I didn't have port 53 open. So I could download web pages but I couldn't actually resolve addresses, causing connection problems.alex@alex-ubuntu-server:~$ sudo ufw status verbose [sudo] password for alex: Status: active Logging: on (low) Default: deny (incoming), allow (outgoing) New profiles: skip alex@alex-ubuntu-server:~$
Anyway, the last thing I have to do is figure out ping. It's supposed to work automagically, but it doesn't. So I'll look at that.
No comments:
Post a Comment
Comment goes here.