Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, telnet, etc. The only software that should use the Internet, that I know of, is iceweasel and apt.

  • Is there a way to ensure that only these two pieces of software can access the Internet?
  • Are any of the harden packages suitable for these needs?

5 Answers 5


In a default user installation, there is only ssh as server application installed which you can simply uninstall via aptitude remove openssh-server or via any other package manager you use.

Restricting network access for applications is difficult. {{ EDIT: However, there is now Leopard Flower developed which seems to provides the features you need (per-process firewall, interactive user interface). }} See Per process firewall? for more information about the topic. Without using complicate solutions, you can only restrict network access to special users via the iptables owner module.

As normal user you do not need any harden-* packages. They either conflict on unsafe packages, which you probably have not installed anyway, or install security packages which are for normal systems too complicated to configure and maintain - like network intrusion systems.


I would agree with the strict use of iptables. It is a very simple commandline based firewall that utilizes the kernel (in most distros).

Another suggestion I would make is selinux. I'm not sure if debian now comes with it by default. Selinux in short is mandatory access control meaning on a kernel level it governs the communication between the application and external resources (i.e files and system properties). As a sidenote, it was also developed with help from the NSA. With selinux profiles you can prevent applications from reading files beyond its scope.

Combined with the best practices such as disabling unneeded daemons, good firewall rules selinux might be the option you are looking for to harden this box.

  • This answer could be improved by providing an example selinux policy which demonstrated doing what the OP was asking for.
    – jmtd
    Mar 5, 2012 at 14:54
  • As requested here is a good Cent OS example of how to harden an apache access using selinux command line. wiki.centos.org/HowTos/… Mar 5, 2012 at 22:55

Unfortunately, there don't seem to be any Linux alternatives to littlesnitch or zonealarm, and most of the GUI'd firewalls will leave you wanting. You can of course do quite a few useful things with iptables and connection tracking so.

One often overlooked utility is tcpwrappers. I would add a rule to /etc/hosts.deny:


Also, disable ping and other ICMP responses by adding the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_all = 1

EDIT: I'm inclined to agree with jmtd, on second thought there are better ways to filter pings.

  • The trouble with tcpwrappers is it's opt-in: The program needs to be linked to the wrappers library for it to actually take effect. iceweasel is not. You could force it to be via an LD_PRELOAD trick if you wanted to.
    – jmtd
    Mar 5, 2012 at 14:52
  • disabling ICMP responses is of questionable benefit security wise, and is not without cost: it can make network interactions a lot slower if a response waits to time-out, rather than getting an explicit deny. Rate limiting responses to protect against DDoS is a much better approach. ICMP-DDoS is almost a non-existent problem for desktop users in the modern age.
    – jmtd
    Mar 5, 2012 at 14:53
  • @jmtd tcpwrapper is not LD_PRELOAD-capable. Programs need to support it. For static linked programs, LD_PRELOAD would not work anyway.
    – jofel
    Mar 5, 2012 at 16:41
  • @jmtd I agree, I've edited my answer. I do however still believe that ignoring pings is beneficial not for protection from ICMP-DDoS just to avoid host discovery.
    – kwarrick
    Mar 16, 2012 at 1:07

Stop all the services you do not wish to start: ssh, smtp, http, whatever else you do not wish to be started. Set up your iptables to block everything accessing your machine or leaving your machine apart from the software that you want.

Note that I am not giving a whole list of commands to type as it is vital that one learns and understands the implications of services and iptables before messing with them.


The most popular basis of network filtering/firewalls on Linux is iptables, which does not work on an application basis. What you need is a security policy program that can restrict programs from being able to access network resources. Two approaches would be SELinux and AppArmor.

Here are some example AppArmor recipes, one of which opens up network access for Firefox/Iceweasel.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .