Firewall Management
Focusing on security
I stated in the first paragraph that firewalls are a single part of an overall security strategy and not a panacea. You have just configured a firewall exception to allow remote access to port 80 for the Apache web server. Doing so creates a vulnerability on the host system. For the moment, assume that you only allow ports 22 (SSH) and 80 (HTTP) on that server system. That’s two vulnerabilities. These are what security people call “acceptable risk.” You have to accept some risk when you allow network access to a system’s services.
The reason allowing access creates vulnerabilities is that you’re allowing computers on a network, and possibly the entire Internet, to access this system via port 80. What if the version of Apache you installed has an unpatched security flaw? Your system is exposed and vulnerable to that flaw until it’s patched. The firewall won’t protect the system because you have allowed access to that port. The door is open.
Is this a real problem? Yes, and no. It is a problem but the alternative is to have no services running on computers, which means you have no customers or employees connecting to those services. That’s not acceptable. There is some degree of risk that you have to accept to run a service. You have to practice due diligence and protect the system in other ways (encryption, application firewall, backups, and monitoring) and routinely patch the system.
Summary
You should have a host-based firewall running on every system on your network—no exceptions. A firewall, as stated previously, is not the perfect security tool, but it does help protect the system from attacks on other services that are not exposed. The same rules apply to network firewalls. This is why you must employ a multi-layered approach to security and not rely on any one technology or solution. Firewalld is installed and enabled by default on all Red Hat-based systems, which should put system administrators at ease that their systems are protected as soon as they’re placed online.
« Previous 1 2
Buy Linux Magazine
Direct Download
Read full article as PDF:
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
Kubuntu Focus Announces XE Gen 2 Linux Laptop
Another Kubuntu-based laptop has arrived to be your next ultra-portable powerhouse with a Linux heart.
-
MNT Seeks Financial Backing for New Seven-Inch Linux Laptop
MNT Pocket Reform is a tiny laptop that is modular, upgradable, recyclable, reusable, and ships with Debian Linux.
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.
-
openSUSE Leap 15.5 Beta Now Available
The final version of the Leap 15 series of openSUSE is available for beta testing and offers only new software versions.
-
Linux Kernel 6.2 Released with New Hardware Support
Find out what's new in the most recent release from Linus Torvalds and the Linux kernel team.