Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have installed the gufw firewall utility and want to make a whitelist of ports (want maximum security, but whitelisting single IPs is currently too tedious). I have so far only entered ports 53 (for DNS), 80 (for HTTP) and 443 (for HTTPS), both in- and outgoing, into the whitelist and closed the firewall, but Ubuntu Software Center can install programs without hindrance, whereas the firewall definitely is running (www content won't load when list entries are not present).

Is it using any of these ports for program data transfer? Seems strange to me. Or is there an overriding exception pre-defined in Ubuntu (this is a new setup, 12.04)? What is probably the case here, and what port does the Software Center use for program data (I assume it does use HTTP for the interface and list entries, but the programs themselves?)?

TLDR:

  1. Why does Ubuntu Software Center get through my firewall which blocks all but DNS/HTTP/HTTPS (via blocking all other ports), so that it can install programs?

  2. Which port does it use for the program data transfer?

share|improve this question
    
I doubt USC uses any port... –  espectalll123 Feb 1 '13 at 14:58
    
Doesn't it technically have to use a port if it transfers data via network? –  DeadCommunist Feb 1 '13 at 15:09
    
@espectalll123 It will definitely use ports for outgoing traffic, but it doesn't need any to listen on (incoming traffic). DeadCommunist: no need to open up ports for incoming traffic in your firewall. Can you inspect the kernel messages in /var/log/syslog to see if there's traffic being blocked? –  gertvdijk Feb 1 '13 at 15:21
    
There are a number of what seem to be outgoing transmissions, all to the same IP, which have been blocked since firewall activation. I do not know what caused them, and as I said the Software Center was able to make an install during the firewall activity. –  DeadCommunist Feb 1 '13 at 15:26

1 Answer 1

up vote 2 down vote accepted

Here's what I found out by running Wireshark while installing a single application using the Ubuntu Software Centre:

  • DNS requests (outgoing to UDP port 53 to your configured DNS server, for...) and HTTP (outgoing to TCP port 80 to...)
    • reviews.ubuntu.com
    • myapps.developer.ubuntu.com
    • software-center.ubuntu.com
  • Everything about your local APT configuration (repositories configured). This is usually either HTTP or FTP and requires DNS as well of course. See your "Software Sources" to see what Ubuntu archives mirror you're using. If you can run sudo apt-get update without errors, you're all set.

Note: I did not find any HTTPS traffic. However, this may be the case for private PPAs (used for commercial software).

share|improve this answer
    
apt-get update seems to work without problems, but does that mean that the Sotfware Center / apt uses only DNS and HTTP (ports 53 and 80 respectively, or 443 for HTTPS) for transfer, or does it mean that it somehow gets past the firewall even though it blocks anything else? (Isn't HTTP only (meant/suitable for use) for Web page content transfer, not bulk data/repo lists/programs/etc?) (sorry for not being well informed) –  DeadCommunist Feb 1 '13 at 15:39
    
@DeadCommunist HTTP is used very broadly for downloading large amounts of data. When you've obtained the Ubuntu ISO file, you've probably used HTTP as well. :) And no, APT cannot go beyond the firewall, but it may be configured to use a proxy server. In that case, it will do the exact same thing in Software Centre for the fetching packages part. I'm not sure about the other content being downloaded (reviews, icons, etc.). –  gertvdijk Feb 1 '13 at 15:48
    
Oh yes of course, most of the common downloads triggered via web pages are via HTTP I guess, what else... So it uses DNS and HTTP (ports 53/80) and perhaps FTP, and I also learned that no exceptions for incoming are required in the firewall except when the other side, desiredly, initiates the contact. The question is thus to be considered solved, thanks. –  DeadCommunist Feb 1 '13 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.