Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On my Ubuntu server I have these services running:

netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      1340/php-fpm.conf)
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      685/mysqld      
tcp        0      0 0.0.0.0:6698            0.0.0.0:*               LISTEN      557/sshd        
tcp        0      0 0.0.0.0:9939            0.0.0.0:*               LISTEN      1457/pure-ftpd (SER
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1479/varnishd   
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      1325/nginx.conf 
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      1435/master     
tcp        0      0 127.0.0.1:6082          0.0.0.0:*               LISTEN      1478/varnishd   
tcp6       0      0 :::6698                 :::*                    LISTEN      557/sshd        
tcp6       0      0 :::9939                 :::*                    LISTEN      1457/pure-ftpd (SER
tcp6       0      0 :::80                   :::*                    LISTEN      1479/varnishd   
tcp6       0      0 :::8080                 :::*                    LISTEN      1325/nginx.conf 
tcp6       0      0 :::25                   :::*                    LISTEN      1435/master 

Since I am not familiar/good with iptable rules I am using ufw to make it simple for me. This is what my ufw status looks like:

ufw status
Status: active

To                         Action      From
--                         ------      ----
6698                       ALLOW       Anywhere
9939                       ALLOW       Anywhere
80                         ALLOW       Anywhere
8080                       ALLOW       Anywhere
25                         ALLOW       Anywhere
6698                       ALLOW       Anywhere (v6)
9939                       ALLOW       Anywhere (v6)
80                         ALLOW       Anywhere (v6)
8080                       ALLOW       Anywhere (v6)
25                         ALLOW       Anywhere (v6)

Would you consider it a reasonably secure firewall rules? Any suggestion?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The general rule with firewall configurations is that you should allow as little access through the firewall as possible.

In the ruleset you've listed you're allowing access to 5 services from anywhere, so if you're on the Internet and there's no NAT device or other firewall between you an the general 'net then anyone can access and attack those services.

It may be of course that, that's intentional (i.e. you're offering public services which should be accessible from anywhere on those ports) however if this isn't the case I'd recommend restricting those to the minimum possible.

As an example if you're not intending to offer any public services (which most client systems won't be) shouldn't be allowing any inbound traffic (apart from responses to connections you start).

Also if these services do need to be accessible but only by certain people, consider restricting the source addresses that can connect to them.

share|improve this answer
    
Thanks for your answer, its a vps webserver hosting a website, intended for public. Port 80 and 8080 is webserver related nginx/varnish. 6698 is SSH server for me to connect from home.25 is mail and 9939 is for ftp for automatic backup with limited user access, auto backup service I am using doesn't use anything other than ftp. I am trying to figure out if firewall can provide extra layer of protection on these open services. –  bran May 8 '13 at 16:55
2  
so it sounds like you have some opportunities for hardening. for SSH you could restrict it to your own IP (if you have a static at home) or your ISPs netblock otherwise. 9939 presumably there's a specific host that connects to you to do the backup? if so you could use the firewall to lock that down to just that IP address. if you're using varnish as as reverse proxy do customers just connect to that on 80? in which case perhaps you can lock down the source addresses for 8080. locking down 25 depends on whether it's an MX for a domain or if it only receives mail from specific hosts... –  Rоry McCune May 8 '13 at 17:09
    
Unfortunately my home connection is dynamic, so I will have to look at netblock whitelist option. I can ask my backup service for a list of ip address I can whitelist for ftp server. Interesting, never thought of it, should be able to block nginx, page is server via varnish. Mail is MX for a domain, but only used to receive alerts and logs to my personal email. Thanks, your answer is very helpful. –  bran May 8 '13 at 17:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.