From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1QuzjE-0005X3-EJ for garchives@archives.gentoo.org; Sun, 21 Aug 2011 04:33:44 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CF88621C30E; Sun, 21 Aug 2011 04:33:35 +0000 (UTC) Received: from svr-us4.tirtonadi.com (unknown [69.65.43.212]) by pigeon.gentoo.org (Postfix) with ESMTP id E489821C043 for ; Sun, 21 Aug 2011 04:31:58 +0000 (UTC) Received: from mail-fx0-f53.google.com ([209.85.161.53]) by svr-us4.tirtonadi.com with esmtpsa (TLSv1:RC4-SHA:128) (Exim 4.69) (envelope-from ) id 1QuzhW-000079-QE for gentoo-user@lists.gentoo.org; Sun, 21 Aug 2011 11:31:58 +0700 Received: by fxd23 with SMTP id 23so3290354fxd.40 for ; Sat, 20 Aug 2011 21:31:54 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Received: by 10.223.25.151 with SMTP id z23mr1575615fab.45.1313901114402; Sat, 20 Aug 2011 21:31:54 -0700 (PDT) Received: by 10.223.96.11 with HTTP; Sat, 20 Aug 2011 21:31:54 -0700 (PDT) In-Reply-To: <21545806.n9l1RQMaLZ@nazgul> References: <21545806.n9l1RQMaLZ@nazgul> Date: Sun, 21 Aug 2011 11:31:54 +0700 Message-ID: Subject: Re: [gentoo-user] Do you block outbound ports? From: Pandu Poluan To: gentoo-user@lists.gentoo.org Content-Type: text/plain; charset=UTF-8 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - svr-us4.tirtonadi.com X-AntiAbuse: Original Domain - lists.gentoo.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - poluan.info X-Archives-Salt: X-Archives-Hash: 1c440e3b6f6096f1b324d74367db1c59 I can feel for 'just-do-whatever-the-damn-auditor-says-so-he-can-stfu' :) I don't really block incoming traffic; instead, I use the TARPIT target (xtables-addons) to make the lifes of portscanners suck ;) Rgds, On 2011-08-21, Alan McKinnon wrote: > On Sat 20 August 2011 10:38:43 Grant did opine thusly: >> I like the policy of blocking all ports in and out with a firewall >> and only opening the ones you need. Bittorrent makes that >> difficult since it connects out to unpredictable ports. Do you >> block outbound ports with a firewall or only inbound? > > For the most part only inbound. Blocking outbound is pretty much > pointless as a security measure. > > You cannot control what people will want to connect to outbound. Every > time you think you have a complete list, someone will come along and > provide you with heaps of reasons as to why their request is legit > (and it usually is!) > > What you can control completely is the services you offer and on what > ports, therefore inbound firewalls make sense. > > That's not to say we don't use outbound firewalls at all, we do - as a > policy measure. Outbound port 25 is blocked so that people will use my > relays instead. I trust them to play nice, they trust me to keep the > service up. For us, this works well. But as a security measure the > entire model falls apart as soon as someone with a clue comes along. I > have this game I play with our firewall/security people where I get to > look smug. Tool of choice? ssh > > The security benefits from outbound connections to my mind are: > warm-and-fuzzy security > cover-your-ass security > just-do-whatever-the-damn-auditor-says-so-he-can-stfu security > i-don't-know-what-i'm-doing security > > but almost never real security. That's better done with permanent ACLs > on the routers. > > -- > alan dot mckinnon at gmail dot com > > -- -- Pandu E Poluan - IT Optimizer My website: http://pandu.poluan.info/