Why is Ubuntu permissive with outgoing connections by default?

Question

I am pretty newbie to Linux, as most of computers for resources in my school use Linux, I just installed Ubuntu to learn.

By default iptables and ufw sets policy as under:

IPTABLES -P INPUT DROP
IPTABLES -P FORWARD DROP
IPTABLES -P OUTPUT ACCEPT

ufw default deny (default incoming).

In both cases, Linux all distros trust all applications including fames ftp, smtp, SSH, mail and all others allowing for outgoing traffic without notice or without concent. Which in turn leaves all 0-to-65535 ports open for outgoing traffic for all installed applications.

Furthermore, there is no particular application control that which particular application like firefox, opera or other are granted access to internet in any firewalls so far I tried. All installed application can freely enjoys all freedom to access internet.

In all major distros netstat is tempered to provide minimum information.

My concern is security.... How much security is offered by the OS (Linux), which allows all outgoing traffic and just blocks the access to incoming?

Answer 1

This sort of discussion comes up from time to time and IMO the best answer is that Linux is not Windows and at this time the current firewall policy is considered sufficient by the Ubuntu developers / security team as, by default, there are no open ports.

See : https://wiki.ubuntu.com/SecurityTeam/Policies

The utility of a firewall in the sort of concerns you have (malware or a cracker using the system for unauthorized activity has been debated but the consensus opinion is that it is not need by default (as you can see). That does not mean everyone agrees with the decision mind you ;)

You are free to disagree with the decision and either change your policies or send a mail to the security team if you wish.

As far as an application level firewall as exists in some Windows applications, suffice it to say it is not so easy to implement and although I have seen a few attempts to code such an application level firewall over the years, but, IMO, the technology is not there yet.

You might want to look at leopardflower I do not use it and can not vouch for how well it works.

Another, older attempt was tuxguardian, but as you can see it is no longer maintained and I would not advise you use it.

The closest thing in Ubuntu would be Apparmor.

https://wiki.ubuntu.com/AppArmor

No it is not precisely what you are asking for, it is just as close as it gets.

Otherwise, IMO, this discussion is age old, if you search the Ubuntu Forums you will find a number of discussion, and also

http://brainstorm.ubuntu.com/idea/4137

Good luck, I hope this post at least provides you with some information, although it is probably not the answer you were looking for.

Answer 2

Outgoing connections require that they be originated from inside the firewall. In most cases this will be a user initiated activity. Configuring a firewall with a closed policy for outgoing traffic is a difficult undertaking and requires maintenance for each new service or Internet client which is installed. Depending on the installed software and use of the system, it is possible the resulting firewall will be almost completely open on all but the privileged ports.

An open policy for outgoing provides a reasonably secure firewall without requiring a significant skill level on the part of the user. The input and and forwarding policies provide a strong barrier against outside attacks and make the system relatively invisible to external probes.

There are programs which require all more most of the unprivileged ports to be open. This leaves only the secure ports (<1024) that can be secured. As on Linux(UNIX)-based system these ports require root privileges before they can be opened, there are few programs that can use them.

Configuring a firewall with a closed policy for outgoing traffic is a difficult undertaking. Firewall rules are required for each service accessed, and in some case the client software or network stack may need special configuration. Many clients default to using ephemeral ports to outgoing access for TCP, UPD, or both as both source and destination The ephemeral port range is effectively all ports over 1024 for forwarding routers and remote addresses.

Answer 3

Why are all outgoing ports open? If you don't trust the applications you are running, then you have bigger problems: There is already an app running, which could do bad things. If you started this application it could remove all files in your $HOME.....

You should trust the applications that are running, if not you have bigger problems than open ports.

If you want to browse the internet, outgoing ports to 80 (http) need to be open. If you have an application that you don't trust, this application could use port 80 as destination an pass your firewall....

If you still want to control outgoing connections, you can do this:

• Disallow outgoing packages.
• run a http-proxy with password access in your LAN.
• Run a Mailserver in your LAN.
• But many applications won't work anymore (Voice over IP, Skype, Chat ....)

But an evil application could read your firefox proxy settings, use the password and send information to an more evil server....

It is hard to control outgoing traffic. I would not do it.