Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

To solve facebook authorization connection on our server, we've decided to open all outgoing connection/ports in firewall to see if it's really security issue.

after allowing, the facebook connection worked.

however i don't have an idea if what are the risks if we fully implement these settings.

thank you!

share|improve this question
add comment

4 Answers

I think the "common wisdom" behind locking down traffic egressing the network has always been something like "Bad people could send traffic out of your network in ways you don't want them to." Certainly, I've seen remote exploits foiled by aggressive firewalls preventing the exploit code from FTP'ing out to download its payload, etc. There's some value in limiting egress ports.

Having said that, though, anything can be tunneled over another protocol (arbitrary TCP over HTTP, SSH over DNS, IP over carrier pigeon, etc), so limiting egress ports to limit egress traffic has an air of a false sense of security about it. Unless you're doing layer 7 inspection of the egress traffic you can't really be sure that the thing making requests outbound on TCP port 80 really is an HTTP client. Even if it is an HTTP client, unless you're being very draconian about the layer 7 examination it may be an HTTP client that's tunneling arbitrary data over HTTP.

Limiting egress ports is a good idea, but don't be fooled into thinking that it's a major "security win". "Smart" software (malicioius or otherwise-- Skype is a good example of a program that handles filtered egress ports very well) will work around you.

As an aside, I'm not aware of Facebook needing anything other than HTTP and HTTPS.

share|improve this answer
2  
IP over carrier pigeon... I love that :-D tools.ietf.org/html/rfc1149 –  Massimo Aug 6 '10 at 5:49
1  
Massimo & John: IP over carrier pigeon became reality back in 2001 :-) blug.linux.no/rfc1149 –  Janne Pikkarainen Aug 6 '10 at 7:13
1  
I wonder if you could implement large packets using tcpdump -> microSD card ? –  Iain Aug 6 '10 at 7:42
1  
@Iain: I didn't think about that. That would radically increase the bandwidth delay product, but you could cope with that and the increased throughput would be worth it. Arguably, though, a station wagon loaded with tapes still has better bandwidth for a lot of situations. Obviously, you network's individual circumstances (linear distance of data transfer, local road traffic conditions, predators, etc) should affect your choice of technology. –  Evan Anderson Aug 6 '10 at 7:50
1  
@Lain-your problem is lack of the proper number of pigeons to carry the station wagon. –  Bart Silverstrim Aug 6 '10 at 11:16
show 5 more comments

If you have any Windows machines on the LAN I strongly recommend closing at least port 25 to all but the mail server(s). Some viruses/worms will cause the infected machine to send spam emails. This can very quickly get you on block lists, which can have a seriously detrimental effect on your ability to send legitimate emails. This happened where I work just after I started there and it took a fair bit of effort to get removed from those lists. There's no real way to tell just how much revenue the company lost as a result but we do know we lost at least some customers.

share|improve this answer
1  
+1 - Total agreement. Blocking outbound SMTP for all hosts on the LAN except the authorized SMTP server is a requirement. (Wish I'd thought of that when I was posting my answer...) –  Evan Anderson Aug 6 '10 at 16:19
add comment

Normally it's a lot more important to block incoming connections than outgoing ones; blocking outgoing connections only makes sense if you fear something you don't trust could run on your server, and this is usually not the point with Linux systems (much more with Windows system, which could easily get infected by worms), and generally with server systems that only admins have console access to, thus reducing the risk of accidentally downloading something bad from the Internet.

That said, you do not need to open anything more than outgoing HTTP (80) and HTTPS (443) in order to access Facebook, which is a web site and doesn't use any other protocol.

share|improve this answer
1  
Not necessarily true; we had a user that managed to infect her system with malware that configured an SMTP server on her workstation, then began relaying spam. Our router blocked port 25 for all but our mail server now to prevent more blacklisting. –  Bart Silverstrim Aug 6 '10 at 11:18
    
@Bart: on a Linux system? –  Massimo Aug 6 '10 at 11:21
add comment

Aside from spamming through SMTP, one thing that I've seen happen is an infected machine on an internal network calls home to a remote IRC server. This is classically used in bot-nets and might benefit from limiting outgoing connections.

However, as others have said, as attacks become more sophisticated, it would be possible to circumvent all these things.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.