It seems to me that there's some sort of "race condition" when you install a new Linux OS (this applies to every OS, but I'll restrict this question to Linux only). When you download the OS for a fresh installation, the image is usually out-of-date. In OS's that have a rolling release policy, the downloaded image is not very old, but in other cases it might be out-of-date by several months. Before you have a secure installation, you need to update it, which usually means that you need to connect to the internet. At this point, when you connect to the internet an before the update is complete, the OS might be vulnerable for a short time (usually minutes or hours).
- Is this something we should worry about for common Linux OS's? I would suppose that remotely exploitable vulnerabilities during this process are non-existent, unless the Linux distribution is really screwed up by default and has insecure services running by default.
- Would it be enough to just block all incoming connections before connecting to the internet? That is: 1) install, 2) set firewall to reject all incoming connections, 3) run updates.
- Are there any best practices to follow to avoid this problem? I know in theory you could download the updates from another machine, and then install them offline, but that seems cumbersome (you'd first need to find out what packages should be downloaded, and for this you'd probably need to test the fresh installation in a VM, etc.)