Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

When I try to telnet to a port on a server, and if there is no program listening on that port telnet dies with a "Unable to connect ... " error. I understand that. But, why do we need a firewall if there is no program listening on any ports?

share|improve this question
    
Defense in Depth. en.wikipedia.org/wiki/Defense_in_Depth_(computing) –  Zoredache Feb 1 '12 at 23:49

4 Answers 4

up vote 27 down vote accepted

There may not be a service running right now, but how about tomorrow? You have them all turned off, but what about your users? Anyone on a unix/windows/mac system can open a port > 1024 on any machine they have access to. What about malware? What about a virus? They can also open up ports and start serving information to the world, or start listening for connections from the network.

A firewall's main purpose is not to block the ports for services you know are disabled, it is to block the ports on services you might not know about. Think of it as a default deny with only certain holes punched in for services you authorize. Any user or program started by a user can start a server on a system they have access to, a firewall prevents someone else from connecting to that service.

A good admin knows what services need to be exposed, and can enable them. A firewall is mostly to mitigate the risk from unknown servers running on your system or your network, as well as to manage what is allowed into the network from a central place.

It's important to know what is running on your machine/server and only enable what you need, but a firewall provides that extra bit of protection against the things you don't know about.

share|improve this answer
1  
> "Any user or program started by a user can start a server on a system they have access to, a firewall prevents someone else from connecting to that service." But, wouldn't this make the service unusable? –  Khaja Minhajuddin Feb 1 '12 at 18:03
3  
@KhajaMinhajuddin yes! That's exactly the point. (-: –  gabe. Feb 1 '12 at 18:08
2  
@KhajaMinhajuddin You only want services that you setup to be available to the world. You don't want the smtp server that super_spam_virus.exe started while you weren't looking listening for connections from other infected systems. A firewall will prevent this, though it's not a panacea. –  gabe. Feb 1 '12 at 18:09
    
super_spam_virus.exe doesn't sound like Unix & Linux :) –  user unknown Feb 2 '12 at 12:41
    
@userunknown true... how about a.out, or a compromised version of /bin/ls that was copied to your system. Or, if you're a developer hg serve which starts a webserver on your machine. Point is, it's trivial to start a server on any machine whether it's used as a 'desktop' or a 'server' doesn't matter. And once that server is started, and you don't know about it... well, that's when the fun starts. –  gabe. Feb 2 '12 at 16:53

Strictly speaking it may not be necessary, however, keep in mind that a firewall can provide more functionality than simply refusing connections over network ports. For example, DROP versus REJECT behavior.

share|improve this answer
1  
What is the advantage of DROP versus REJECT? –  user unknown Feb 2 '12 at 12:42
    
I'm not sure, but I believe DROP just doesn't respond so the requester doesn't even know if the request was received or if your machine exists. REJECT says you're definitely there and just don't want to talk about it. And, if something's behind a locked door, it might be worth trying to find a way in to find out what's worth protecting. –  Joe Feb 4 '12 at 0:00

IF there is no program listening on any port, you don't need a firewall, but you also can't connect to your server because it is 'sealed' from the rest of the world.

On the other hand ... let's say your server does not have any locally running program listening on any port, but it serves as a gateway for other computers behind it. In this case you use a firewall to manage the masquerading (NAT) and optionally you can filter some stuff on packet forwarding.

share|improve this answer
    
This is a good point, but if I want the server to do stuff( I usually would put openssh and a webserver). Even with a firewall, I have to open ports to make the running apps like openssh and webservers useful. So, I guess what I am asking is, Are there any programs which open up ports to the outside world which need to be blocked by a firewall and which would still be useful. –  Khaja Minhajuddin Feb 1 '12 at 17:59
1  
Yes there are. Not necessary an example for a server, but let's presume you have a Linux machine with X installed, and X running on a network port. You would want to allow your computer, maybe some other computers from the LAN to connect to your X. However you would not want Joe from France to connect to it. Another example, let's say you set up multiple VPN services on your server and you need to control which networks can see other networks (or not to see). Or, let's say you have OpenSSH but you want to allow connection only from your home computer. There are many other examples. –  Patkos Csaba Feb 1 '12 at 18:28
1  
@KhajaMinhajuddin: For ssh, you should use the /etc/ssh/sshd_config to secure the machine. PermitRootLogin should be set to No, you should use a secure password and maintain the machine with sudo (you may use sudo after logging in with an account with sudo permissions). Setting the restrictions with a firewall is just the wrong tool for the job. The same would be true for a postgresql database: Use the database configuration, to set and revoke permissions. –  user unknown Feb 2 '12 at 19:52

But, why do we need a firewall if there is no program listening on any ports?

If you have a Single-User Desktop, not a server, you don't need a firewall, if there is no service running, as on a default Ubuntu installation.

Windows had some times, after being able to do networking, some services running on default for maintenance, updates, internal message passing and so on. You couldn't stop them, without stopping windows working, but they where vulnerable for external attacks. So the windows users needed a firewall, and the meme, that everybody needs a firewall, spread fast.

When they met the Linux folks, which often were server admins, they didn't say 'you don't need a firewall on linux' but 'we have free firewalls like iptables for nearly a decade'.

A personal firewall, sitting on the system it shall protect, isn't the best idea either.

On a single user desktop system, you don't need a personal firewall.

share|improve this answer
3  
Look at the answer from gabe and rethink. Especially the Desktop clients are vulnerable to attacks. –  Nils Feb 1 '12 at 21:29
1  
@userunknown: a virus might be a user of your desktop. A daemon that you install and fail to configure is too. –  André Paramés Feb 2 '12 at 1:59
1  
I have run security testing for many years, and access through desktops is a very useful route to propagate an attack. Doesn't matter if it's Windows, Linux, Solaris, whatever. Lock it down or lose it to an attacker. The correct phrase should be you may need a firewall on your desktop - fully assess the risks in your environment –  Rory Alsop Feb 2 '12 at 12:11
2  
@userunknown just because you use a computer as a desktop doesn't mean it's not still a server those are just words. Your desktop has plenty of servers that could potentially run on it, and possibly that already are. –  gabe. Feb 2 '12 at 16:58
1  
Think about CUPS (any linux), SLPD (SuSE) and other stuff (KDE-remote, iSCSI-server/client) that may be running on linux after an update. Even if you checked before these things may appear. If they do it is good to block them. BTW - activate your firewall via GUI (dont allow anything) on RedHat, start CUPS and see if you can connect to it from outside. Then look at iptables-save`: Voila - the CUPS port is open without showing up in the gui... –  Nils Feb 2 '12 at 20:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.