Firestarter on debian server. Should I activate SSH?

Question

I have just installed Firestarter on my Debian server, because I want an easy-to-use tool to administer the firewall on this server. The plan is to restrict access to some ports (e.g. 8080) and I've thought that an inbound rule is the right choice.

Am I on the right way?

I've added an example rule, which restricts access to port 8080 to IP adress 127.0.0.1. (will change 127.0.0.1 later to the right one).

Another problem is, that I don't know if I should also activate SSH access or if this is activated by default. I am a little bit scared, that if I don't allow access to it in Firestarter, that I will take access from myself. :)

Answer 1

First of all, yes, you are on the right track. It is somewhat unusual to use Firestarter on a a server, but it is definitely possible. You are further correct that inbound rules are what you use to limit what traffic can get into the server.

SSH is a bit of a tricky one, which depends on a few other things. If your server is hosted in a data center and all you have is SSH access, then obviously that port has to be open. At the same time you want maximum protection, and the usual solution for this is to use a private/public key pair (generated with ssl-keygen) and to disable password authentication. Make sure your key authentication works before you do that, otherwise you'll have locked yourself out.

OTOH, if you have physical access to the server and there's no need to use SSH to manage the server (and by the looks you even have a GUI running on it), then I'd say close the port. The fewer open ports you have, the smaller the risk of anybody hacking in.

If your server has got no other firewall, then by default all ports are open. You should be able to set the default policy in Firestarter to "REJECT", which will close all of them, except the ones you specify as open.