Re: Why not have firewall rules by default?

Florian Weimer <fw@deneb.enyo.de> writes:

> The daemon might have been installed by a package dependency, more or
> less by accident. Debian should have a policy that all daemons bind to
> the loopback interface by default, but as long as this is not the case,
> I can understand why people put paket filters on hosts as a safety net.

This would be a rather silly policy to have for, say, a Kerberos KDC or an LDAP server. The normal installation for such packages is on servers, and defaulting to not providing the service just makes the administrator jump through unnecessary hoops and isn't consistent with the idea that installation should result in a working package.

-- 
Russ Allbery (
rra(at)debian.org)               <
http://www.eyrie.org/~eagle/>


-- 
To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org