0

As I'm working on an OpenSource application, that application is to serve Web pages to clients. It also supports a mailserver, DNS, and runs with the Cassandra database.

What I have done is setup a firewall that gets installed with the application. This means it is available with the OpenSource application (i.e. anyone, including hackers, can see the rules that are going to be applied to the firewall.)

The rules are as restrictive as possible, as far as I can tell, so I'm not too worried about that in particular.

However, I'm wondering whether having the firewall rules in clear for anyone to see would include blackhats that could then benefit from having the source of such. Is that indeed a potential problem? Are there recommendations available out there on this subject?

Obviously, the firewall is not the only security feature included in the system, but that's certainly one important one.

1

If knowing your firewall rules helps a hacker, then not publishing them is only security through obscurity.

Just like the rest of your code, if your firewalls are configured securely, knowing the exact configuration is irrelevant. On the other hand, if it is not configured correctly, then there is no real security to prevent exploitation.

On the plus side to open-sourcing your rules, others can inspect them and verify they are correctly if it concerns them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.