-1

in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny: 

 ALL:ALL

Everyone said that configuring a proper firewall on Linux is much more difficult than on BSD etc., so just do this one thing and it will be fine. However I know I don't really know if this is sufficient or desirable so can someone please tell me? I do eventually want to set up iptables so that I can block some outgoing traffic too.

Improve this question

2 Answers 2

Reset to default
3

Everyone said that configuring a proper firewall on Linux is much more difficult than on BSD etc., so just do this one thing and it will be fine.

Rubbish. Linux distributions have perfectly good GUI firewall configuration tools available that is more than sufficient for configuring which services are allowed through. It is only when you want to get into more complicated NAT or forwarding rules that you have to dive into iptables syntax.

Even the basic iptables syntax is pretty simple to understand. For a good baseline configuration, I point you to a blog post by @ScottPack on our community blog.

Improve this answer
2
  • You say tools exist, then you never identify them. Hmm.....
    – Friendly
    Commented Oct 14, 2013 at 15:46
  • 1
    @Friendly RHEL-based systems has system-config-firewall. Not sure what the Debian-based one is called but a quick Google search will reveal the answer.
    – user10211
    Commented Oct 14, 2013 at 15:52
2

This isn't a firewall. Instead it's an authentication override that many services use. If your host isn't allowed, then the service (not the firewall) won't allow you to connect. Not all services respect the hosts.allow or hosts.deny files though. And more importantly, if a service is exploitable, then then the attacker may be able to bypass the hosts.deny check. After all, you're if all the services were working properly, then you won't need the firewall in the first place.

As for firewall configuration being more difficult than on BSD, I assume you got that answer because you talked to someone who is more familiar with BSD. IPTables is pretty straight-forward once you understand the paradigm that it's following. BSD's PF attempts to take a slightly higher-level approach than IPTables, but in the end they're more similar than different.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .