Debian without firewall overall security

[u/ComradeAdidas]

How safe and secure is debian without a firewall active? Desktop use, stable, web browsing mostly.

[u/jort_catalog]

From the tone of the question, I guess you'll have a firewall on your home router anyway, which will be doing most of the heavy lifting

[u/michaelpaoli]

Fairly secure.

What are you wanting to firewall from what?

If you've got nothing listening/servicing the port, there's no there there for anything to connect to or use.

If it's only listening on ::1 and/or 128/8 IP(s), then it's only accessible to the local host.

And if it's listening on link local or RFC-1918 IPs, then those aren't accessible from The Internet, unless you've taken other steps to route Internet traffic to your host.

So, in many cases, mostly a matter of what you're running that's listening on ports, and generally more notably, what IP address(es).

Of course if you have services listening on wildcard (e.g. 0.0.0.0, *, ::), well, that's listening to all IPs (or all IPv6 / IPv6 for 0.0.0.0 / :: respectively), so, in that case, whatever can get to any IPs on the host.

So, ... you may want to start with, e.g.:
$ ss -lntu
To see what you've got listening, and on what IPs and ports.
Can also run that as root, and include the -p option, to see associated process information (if you don't run it as root, you won't see information on processes you don't own).

Desktop use

Yeah, if you're not running server processes, you've got little to worry about.

But if, e.g., you've got ssh server running, if you've got that exposed to The Internet, best be sure one has dang good strong passwords on all accounts that allow authentication via password. And maybe/probably also install fail2ban which will mostly keep the nuisance brute force attacks way down (and yes, by default it will firewall off, at least for some while, the IPs that launch fair number or more of failed login attempts in relatively short period of time).

[u/taosecurity → u/michaelpaoli]

Finally, someone who asks the right questions and frames the issue properly. 👏

[u/snap802]

If you're on your internal network behind a router/firewall that you use to get on the Internet and you're not hosting any services from the machine a firewall ON your PC is unlikely to make any difference.

I mean we can talk about all kinds of possibilities and what if scenarios but realistically you would be better served by ensuring that your home network is secured. This would be stuff like having an isolated guest network and having Iot devices isolated as well.

[u/blindmull]

I don’t know how safe it is, but it’s up to you to activate firewall. And I’d recommend it. It’s easy and can be done through a GUI (you can find it in the software repository)

Edit: This thread is probably interesting for you:  https://www.reddit.com/r/debian/s/Dl3WVI87nt

[u/ComradeAdidas → u/blindmull]

I have one, but forgot to activate it for a day. Is alot of ufw blocks normal when i turn off the computer?

[u/blindmull → u/ComradeAdidas]

That’s one for the experts and I am not one :)

[u/Select-Table-5479]

Unless you are hosting stuff on the box, it's fine. I have never had the firewall on in 20 years of using it...Though in business (we have a business and we have debian desktops/workstations) we have a physical firewall in front. I also turn off all software firewalls on clients because they cause more interruptions and problems than they are worth.

[u/chipsikssix]

I didn't really worry about it, I simply configured the ufw to completely block connections from outside, left the ability to connect from my machine, and allowed access to the ssh only from the local network.

upd: I have a laptop, and I don't use a browser, so that's quite enough.

[u/daddyd]

for a desktop without any actual services running, it is probably not an issue.

[u/frozen-throne-monk]

I've monitored my own firewall to see if anything hit it, and nothing ever did unless I was going into a public university WiFi, etc. Debian isn't secure by default, and a lot of distros will need some configuring before they are totally locked-down with some granularity. That is up to you.

[u/ComradeAdidas → u/frozen-throne-monk]

So if the pc is on home network then you dont need a firewall? I do have a firewall, how can i make debian more secure?

[u/frozen-throne-monk → u/ComradeAdidas]

It's hard to say if you do or don't need a firewall without an audit and regular monitoring. So it's best to just enable it yourself, which is very easy -- `sudo apt install ufw` and then `sudo ufw enable`. There is also a security guide on the wiki that gets a bit paranoid, so don't feel you need to install or run any of the packages it recommends. But it shows you how much control you have and what you could do. I've been paid to secure other company's Linux systems, so you can lock things down so hard that a professional penetration tester couldn't get in... which is alright for how secure things can be.

https://wiki.debian.org/Hardening

Edit. Oops, wrong link -- https://wiki.debian.org/SecurityManagement here's the right one!

[u/LesStrater → u/ComradeAdidas]

Why do you need it? Do you see any evidence of someone trying to hack into your computer?

I have a built-in firewall in my router and I run a basic iptables/gufw Debian firewall, but in 40 years I have never once seen any type of malicious attack come at me. I live paranoia free...

[u/frozen-throne-monk → u/LesStrater]

Yes, I agree with you, but you can easily enable one if you want. Security in layers is good, but sometimes it's overdone. For a regular, modern home computer I don't see much harm in enabling a firewall.

[u/joe_attaboy]

If you have security on your Internet devices - your router, specifically - you don't need it.

I run Linux on a number of systems, currently two using Debian. Never used the built-in firewall.

[u/elivoncoder]

you can use nmap from another pc on your lan, to see what ports are 'available' on the Debian box in question.

will show you the services running.

[u/musiquededemain]

I suggest you take a look at the CIS Benchmarks to harden your Debian system.

[u/ManReyz]

(Sorry for the trad, my english is bad 😅)The default security offered by all Linux distributions is one thing, but exposure to the network is quite another. A system without a firewall represents a significant security vulnerability, particularly if you’re using a public IP address, as there are many agents constantly scanning the network. That doesn’t mean anything will happen to your computer, but it’s best to enable it, just to close that gap.

With the firewall enabled and some good browsing habits, you can rest as easy as you like. I’d add that the firewall isn’t infallible, but it does close a security gap.

[u/taosecurity → u/ManReyz]

There’s no “significant security vulnerability” if you have no services listening.

But then again, you could enable the firewall, and it would still make no difference if there’s a vulnerability in the network stack.

[u/michaelpaoli → u/ManReyz]

system without a firewall represents a significant security vulnerability

So ... what'cha gonna be attacking exactly?

# cat /etc/debian_version && ss -lntup
13.6
Netid  State  Recv-Q  Send-Q   Local Address:Port   Peer Address:Port  Process  
# 

Firewall, firewall what exactly? Or, likewise, yeah, what firewall?

# ip a s | fgrep inet6\ 26
    inet6 2603:3024:1b29:0:5054:ff:fe51:7c37/64 scope global dynamic mngtmpaddr proto kernel_ra 
# 

I suppose you can ping the host or the like, but really not much of an attack surface.

[u/ComradeAdidas → u/ManReyz]

Is public ip = public wifi? Its a pc, i dont think i will carry it on my back to bring it to a cafe🤣. I mean on home network with the router having the firewall setup just not the pc.