I have a set of INPUT chain rules restricting traffic based on source ip and destination ports.The services are ftp and a job service.The server has a public ip address.
The default policy of the INPUT chain is deny. The default policy of the FORWARD chain is deny.
The only service accessible from any ip address is the ssh service(updated software).
There is only one user on the system, that is the admin user.
My question is, is there any utility in putting OUPUT chain rules on this machine. And have any one of you come across attack cases where the attacker is able to initiate network connections from the machine without getting root access ? (if the attacker gets root access, then he can simply knock off the iptable rules)