-3

I have an AWS server. I didn't want to spend too much time configuring the Security Group and allowed all inbound and all outbound traffic. Is this OK or is it a bad idea?

  • Are you asking whether it is important to have a firewall at all for internet-connected servers? – schroeder Dec 16 '16 at 7:46
  • Yes, I suppose in a way but for example, outbound traffic. What's the harm in allowing all outbound traffic? – user133587 Dec 16 '16 at 7:59
  • You control the flow of traffic to mitigate risks. The potential risk is that if your server is hacked, then the attacker has no restrictions on what he can do to connect out from your server. Like SSH. The general idea for security is to only allow access to resources that something needs to do its job. If you are hosting a web server, then it probably doesn't need to be making outgoing connections to anything non-web. – schroeder Dec 16 '16 at 8:09
1

Restricting inbound traffic is fairly easy to understand: if, say, you're running ssh and only ever access this server from your internal network, then allowing people from the broader internet to connect to sshd is providing an attack vector. Yes, you should be using only key-based authentication, and yes, you may be using something like fail2ban, but having more layers of protection is good to protect you when the others fail.

Restricting outbound traffic helps keep an attacker who's comprised your server from exfiltrating information or poking holes to give themselves remote access.

0

The least priviledge rule is among the basis of security (note that it is not restricted to IT security...). If everything was at an ideal level (no evil guys trying to break your machine, no flaws in any installed software) restricting traffic would just be loss of time.

Unfortunately, there may be security flaws in numerous pieces of software, making them vulnerable to different attacks, Of couse I assume that you read CERT advisories and patch all known vulnerability. But restricting traffic is just another defense line to limit exposition of your machine to what is stricly required. That way, even if you have forgotten an unpatched piece of software, no evil guy could make use of it if the firewall blocks any communication with it.

That being said, security is always a balance between risk and cost, so if it is only a test machine, it may not be worth the cost of securing it (even if using best practices in always good on a learning point of view). But the decision and the risk is your own problem. Caveat emptor...

  • Then someone finds an exploitable vulnerability that could have become non-exploitable simply by judicous application of the rule of least privilege, and enlists the system in a botnet... – a CVn Dec 16 '16 at 12:27
  • @MichaelKjörling: It is one of the risks, with all possible consequences, from your account being suspended to legal suites... – Serge Ballesta Dec 16 '16 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy