Linked by Igor Ljubuncic on Mon 21st Jun 2010 09:35 UTC
Privacy, Security, Encryption I've bored the readers of my personal website to death with two rather prosaic articles debating the Linux security model, in direct relation to Windows and associated claims of wondrous infections and lacks thereof. However, I haven't yet discussed even a single program that you can use on your Linux machine to gauge your security. For my inaugural article for OSNews, I'll leave the conceptual stuff behind, and focus on specific vectors of security, within the world of reason and moderation that I've created and show you how you can bolster a healthy strategy with some tactical polish, namely software.
Thread beginning with comment 430913
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE: insecurity
by fewt on Mon 21st Jun 2010 15:20 UTC in reply to "insecurity"
fewt
Member since:
2010-06-09

Firewall won't save you from anything by itself and the only meaningful reason of using fws is when certain hosts need access to certain service. On a workstation you can pretty much disable/remove every network daemon like ssh, apache, mysql etc. or if you need them to develop stuff then just bind them to localhost.


A local firewall is very useful, even on a Linux computer when it's directly connected to the internet (home, free public WIFI, etc).

There are a lot of network based attacks that computers without firewalls are vulnerable to.

man in the middle attacks, spoofing, etc. It also keeps ports that shouldn't be exposed to the internet away from the internet.

Reply Parent Score: 1

RE[2]: insecurity
by xaeropower on Mon 21st Jun 2010 18:32 in reply to "RE: insecurity"
xaeropower Member since:
2005-12-16

"Sure beats most the Windows junk AV's"

I don't think that any antivirus company even consider clamav as a competitor or care to share samples with them this is the reason why their signature db is nowhere compared to the "junk avs" you mentioned. My experience is that clamav not just gets sigs for a certain malware later but it doesn't have a signature from 10/8 files.

"There are a lot of network based attacks that computers without firewalls are vulnerable to.
man in the middle attacks, spoofing, etc."

I don't see how firewall would help you in a MITM attack. There is a publicly available tool called ZXARPS which is able to intercept/change traffic between hosts in the same broadcast domain (eg between yout laptop and default gateway), try to defend your box against that with iptables ;)

"It also keeps ports that shouldn't be exposed to the internet away from the internet. "

The thing is that you are almost always behind a NAT device whether you using your laptop in a corporate network or just at home behind a dsl router but don't get me wrong having a firewall in situations where you for example have a samba server running on your laptop what you need to access when you are home is ok.
Using premade firewall rulesets however what the user in many cases don't understand and probably just an "input only" ruleset doesn't help much.

Reply Parent Score: 1

RE[3]: insecurity
by fewt on Mon 21st Jun 2010 19:07 in reply to "RE[2]: insecurity"
fewt Member since:
2010-06-09

"There are a lot of network based attacks that computers without firewalls are vulnerable to.
man in the middle attacks, spoofing, etc."

I don't see how firewall would help you in a MITM attack. There is a publicly available tool called ZXARPS which is able to intercept/change traffic between hosts in the same broadcast domain (eg between yout laptop and default gateway), try to defend your box against that with iptables ;)


Depends on the attack really, a firewall shouldn't be the only line of defense. ;)

"It also keeps ports that shouldn't be exposed to the internet away from the internet. "

The thing is that you are almost always behind a NAT device whether you using your laptop in a corporate network or just at home behind a dsl router but don't get me wrong having a firewall in situations where you for example have a samba server running on your laptop what you need to access when you are home is ok.
Using premade firewall rulesets however what the user in many cases don't understand and probably just an "input only" ruleset doesn't help much.


That is a fair point, but it requires that the user remember to turn on and configure a firewall during times that they aren't protected by some other method.

Reply Parent Score: 1

RE[2]: insecurity
by rexstuff on Mon 21st Jun 2010 18:50 in reply to "RE: insecurity"
rexstuff Member since:
2007-04-06

There are a lot of network based attacks that computers without firewalls are vulnerable to.

man in the middle attacks, spoofing, etc.


What?!? How exactly does a firewall mitigate man in the middle attacks or spoofing? That's just silly.

Reply Parent Score: 2

RE[3]: insecurity
by fewt on Mon 21st Jun 2010 18:58 in reply to "RE[2]: insecurity"
fewt Member since:
2010-06-09

"There are a lot of network based attacks that computers without firewalls are vulnerable to.

man in the middle attacks, spoofing, etc.


What?!? How exactly does a firewall mitigate man in the middle attacks or spoofing? That's just silly.
"

Spoofing IS a man in the middle attack.

- http://www.fwbuilder.org/4.0/docs/users_guide/ch15s02s06.html

- http://www.cipherdyne.org/LinuxFirewalls/ch01/

- http://www.aboutdebian.com/firewall.htm

Reply Parent Score: 1