1

I am running my own small UDP linux service on a dedicated server. my service responds to single-package requests with single-package responses. I don't want this server to do anything else. I don't want it to access or serve the web, allow remote logins, go out to log in elsewhere, download files, etc.

I do not need or want any TCP higher-level protocol access. I figure that if I just run my own UDP service (I don't even need DNS, but this is UDP), and TCP is not available, it would be VERY hard for a remote hacker to intrude. even running my service on a non-upgraded linux distro would then remain reasonably safe.

of course, I can install firewalls, on and around the server, to block all TCP traffic. (and then I would have to make sure that my admins don't have a weak moment, where they disable the firewall and punch through it.) thus, I would prefer the simplicity of not even having TCP enabled in the linux kernel--rather than having it, and then trying to block it.

I would presume that a similar strategy would be useful for many small devices that are now creeping up in our houses. I would want my lightbulbs to listen/respond to very simple UDP requests, and not run a full network stack all the way up to TCP.

is this possible in a linux-based system? or another unix-style OS?

  • 2
    You realize that UDP and TCP are Transport Layer protocols right? – RoraΖ Feb 25 '15 at 18:59
  • 1
    I'm not sure that disabling TCP greatly benefit security. Most secure protocols rely on a sustained connection (SSH, IPSec). There is DTLS, although I'm not sure how widely supported it is. – RoraΖ Feb 25 '15 at 19:06
  • yes, I do realize that they are layer protocols. I believe the protocols are layered---TCP uses UDP and adds important useful features to it--and not comingled. I could be wrong. say I wanted to run a dedicated DNS (not DNSSec) server over UDP, for example. I could then shut down every TCP access from or to my server. – ivo Welch Feb 25 '15 at 22:50
  • TCP and UDP are independent of each other – RoraΖ Feb 25 '15 at 23:59
2

UDP alone does not provide any kind of security, that is neither encryption nor authentication of the peer and not even protection against spoofing of the peers IP address.

Insofar it is not suited for any kind of important controls (which might even be switching lights) unless you have the surrounding network protected by some other means. But in this case there would not be any security advantage of running a minimal stack only, only the memory footprint of the device could be smaller.

So for any kind of real controls you need at least protection against spoofing, i.e. authentication of the peer. This is not as simple as you think because this authentication must also be safe against an attacker sniffing the communication and replaying it later. Once you add all the protections to your device it gets more complex so the original simplicity of your approach is no longer there.

it would be VERY hard for a remote hacker to intrude.

If you only think of an remote attacker accessing a device inside your own network, than it does not matter if you have TCP or UDP as long as the device is not reachable from outside. But if the device is reachable from outside or if the attacker managed to get into your own network (like when you do web surfing and get a drive-by-download exploit) then it would not be a problem for the attacker to do harm against an unsecured device, no matter if it uses TCP or only UDP.

| improve this answer | |
  • let's say my attacker sits in my network. he can sniff my UDP packets. but he won't be able to ssh into my UDP server and install malware on it. nor will my own people be able to install external software from the internet---no ftp, no web browser, etc. – ivo Welch Feb 25 '15 at 22:42
  • 3
    If you have no ssh etc running it cannot ssh into the server. This has nothing to do with TCP vs. UDP but with enabling or disabling services. There can be vulnerable services on UDP too. – Steffen Ullrich Feb 25 '15 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.