What is a practical way to manage a whitelist of firewall outgoing connection rules for http://security.debian.org (on a server that blocks all outgoing connections by default)?

My understanding is that security.debian.org is a CNAME to several mirror IPs, and it is advisable to use only IP addresses (not hostnames) in firewall rules.

At the moment I simply add newly resolved IPs to security.debian.org to my firewall (ufw) outbound rules as I discover them. However this is cumbersome and doesn't allow for automated apt-get updates.

Can anyone suggest a better way?

PS: I found the following page somewhat relevant but it did not provide a solution: http://www.debian.org/doc/manuals/securing-debian-howto/ap-fw-security-update.en.html


The real solution would be to check all DNS resolving actions. If you can make the (local) DNS server (which is used by the restricted system) log all activities then you can grep all inquiries for security.debian.org, compare the result to your list of IPs and update the firewall in case the IP is new. That's probably not fast enough for the first connection try but should not cause problems.

An alternative would be to configure a static resolution of this FQDN (either in /etc/hosts or in the DNS server) and allow the configured addresses only. From time to time you would resolve this FQDN externally and update the local configuration if necessary.

  • Thanks for the advice Hauke. I'll try the /etc/hosts option on the local machine first, as I am using Google DNS servers rather than a local DNS server. I appreciate your help. – Toby Jun 3 '13 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.