What I learned while securing Ubuntu (2015)

Re:What I learned while securing Ubuntu (2015) by polard2 on Friday June 10, 2016 @03:23PM (#11879217)

Since Ubuntu doesn’t come with a firewall enabled by default, your postfix server is listening on all interfaces for mail immediately. The mynetworks configuration should prevent relaying, but any potential vulnerabilities in your postfix daemon are exposed to the network without your consent. I would prefer to configure postfix first before I ever allow it to run on my server

Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway? I mean, I generally install server with nothing. Set up iptables. Then install packages and open ports.

[ Parent | on HN ]

Re:What I learned while securing Ubuntu (2015) by smacktoward on Friday June 10, 2016 @03:52PM (#11879484)

> Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway?

But why expect the user to do that themselves? Shouldn't security be the default, with a secure configuration provided out of the box?

Giving the user a secure configuration which they can then opt out of if they wish does better by the user than giving them an insecure configuration and then asking them to opt in to security does.

[ Parent | on HN ]

Re:What I learned while securing Ubuntu (2015) by vacri on Friday June 10, 2016 @08:58PM (#11881383)

If the user can't do that, then the user is not going to have the chops to configure Postfix anyway.

Seriously, Debian is the upstream distro does this, and it's the other linux grandparent with RHEL. It's been around for decades, used in production the same way RHEL and BSD are, and we haven't had debian-based boxes compromised left, right, and centre with these 'insecure' defaults. The threat is imaginary, and not born out in real world numbers.

[ Parent | on HN ]

Re:What I learned while securing Ubuntu (2015) by riprowan on Saturday June 11, 2016 @10:24AM (#11883541)

> Since Ubuntu doesn’t come with a firewall enabled by default, your postfix server is listening on all interfaces for mail immediately.

But Ubuntu doesn't come with a postfix server enabled by default, so that's not really a concern, is it?

[ Parent | on HN ]

Re:What I learned while securing Ubuntu (2015) by JdeBP on Sunday June 12, 2016 @09:55AM (#11888091)

Ubuntu does, however. Here is its guide:

* https://help.ubuntu.com/lts/serverguide/postfix.html

Here is where it is enabled by default:

* https://git.launchpad.net/postfix/tree/debian/postfix.postin...

And here is where the installation process auto-starts the server:

* https://git.launchpad.net/postfix/tree/debian/postfix.postin...

[ Parent | on HN ]

Re:What I learned while securing Ubuntu (2015) by riprowan on Sunday June 12, 2016 @10:24AM (#11888206)

Well I never. TIL. I've always installed and started it because I assumed it wasn't already running.

Thanks!

[ Parent | on HN ]