10

Firewalls are typically employed to prevent bad "packets" coming in from the outside world. But these days we are mostly behind routers and a lot of that danger is mitigated by the router. The danger we face is mostly from within. The proverbial Trojan horse.

In Windows world there are a lot of Application Firewalls and OSX has a neat utility called "Little Snitch" with does this job of ensuring applications behave by not requesting data outside of their scope. Even my iPhone, jail broken, has an app that prevents applications from accessing web site outside of their scope. Its surprising the amount of data they "push" to web sites like scorecard.com and a variety of apple servers. I disable these and the applications still work so I know its not necessary.

In Linux world there seems to be little in this vein. You can kludge it with iptables and some other scripts in perl to get the result in a very clumsy way.

Take this post which is frequently referenced when a question like this is asked.

How to control internet access for each program?

It doesn't answer the question.

They talk about firewalls that totally cut of a port which is not what most people want. All most people want is that application X which should be a local app doesn't go out and chat to the web when it has no need to chat to the web. Or a program that access yahoo weather goes to five other sites not related to its job of accessing the weather. Or in my one of my banking apps on iPhone goes outside of the bank to a webtrends web site. Sure its not related to Ubuntu but is an example of Apps behaving badly.

The other app referred to in this post is Leopard Flower which hasn't been updated in a year and I'd hate to keep that running with the up coming release of Ubuntu.

All other posts related to this area keep making recommendations for apps that totally cut off access for an application but don't provide that simple "Little Snitch" idea of App X wants to access Web Y, Allow or Deny access. No complicated iptable rules, no total port cut offs.

Have I looked hard enough or is there simply no "Application Firewall" for Ubuntu?

4 Answers 4

4

AppArmor

AppArmor is a Linux Security Module implementation of name-based access controls. AppArmor confines individual programs to a set of listed files and posix 1003.1e draft capabilities.

below link.

https://help.ubuntu.com/community/AppArmor

1
  • Same as SELinux, a sledgehammer approach to a simple problem. If I install it then I need to worry about all of the other applications that will fail. It was the first program I removed when I installed Ubuntu.
    – Meer Borg
    Apr 5, 2013 at 3:28
1

SE Linux is one example of application level firewall for Linux but its quite hard to implement it as its very thorough.

1
  • Have used it in the past, causes more problems than it solves.
    – Meer Borg
    Mar 30, 2013 at 2:48
1

I don't know what you find so bad about apparmor. Of course, it requires a bit of reading man pages. But other than that, I find it easy to use.

I have used personal (i.e. app) firewalls in the past, when I was still using Windows (at work). I don't find apparmor in any way lacking, except for the lack of a GUI. In turn, however, it provides additional security features - you can't prevent a DoS attack by a program which just eats up resources with a personal firewall for Windows, while you can do so with apparmor.

Besides, it has nice diag and management tools - look up aa-unconfined and all other aa-* commands (you need to install apparmor-utils first).

You will see that even with the minimal configuration you get when installing a default Ubuntu system you are still pretty well protected. This has a lot to do with the setuid mechanism and several low level operations requiring privileges on Linux - most apps don't ever access the network directly.

Aside, from that, look up Tomoyo. It's not yet as mature as apparmor or SELinux, but I think it's worth a shot.

1

May I suggest you to have a look to my app http://douaneapp.com/.

It is an application firewall, limiting the network access per application. Feel free to send me comments and feedbacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .