Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have just installed Firestarter on my Debian server, because I want an easy-to-use tool to administer the firewall on this server. The plan is to restrict access to some ports (e.g. 8080) and I've thought that an inbound rule is the right choice.

Am I on the right way?

I've added an example rule, which restricts access to port 8080 to IP adress 127.0.0.1. (will change 127.0.0.1 later to the right one).

Inbound rule in Firestarter

Another problem is, that I don't know if I should also activate SSH access or if this is activated by default. I am a little bit scared, that if I don't allow access to it in Firestarter, that I will take access from myself. :)

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

First of all, yes, you are on the right track. It is somewhat unusual to use Firestarter on a a server, but it is definitely possible. You are further correct that inbound rules are what you use to limit what traffic can get into the server.

SSH is a bit of a tricky one, which depends on a few other things. If your server is hosted in a data center and all you have is SSH access, then obviously that port has to be open. At the same time you want maximum protection, and the usual solution for this is to use a private/public key pair (generated with ssl-keygen) and to disable password authentication. Make sure your key authentication works before you do that, otherwise you'll have locked yourself out.

OTOH, if you have physical access to the server and there's no need to use SSH to manage the server (and by the looks you even have a GUI running on it), then I'd say close the port. The fewer open ports you have, the smaller the risk of anybody hacking in.

If your server has got no other firewall, then by default all ports are open. You should be able to set the default policy in Firestarter to "REJECT", which will close all of them, except the ones you specify as open.

share|improve this answer
    
Hi, thanks for the nice answer. I have not so much experience with firewalling servers, but what kind of tool would you recommend instead of Firestarter. I know there are other tools like guarddog, but I think all these GUI tools are a matter of taste. But what is a more proper way for administer the firewall on a server? –  High6 Jun 20 '11 at 14:28
1  
All GUI tools for firewalls have one thing in common: they cannot utilize the full set of features available from the underlying real firewall, which on Linux boxes is usually iptables. Most of our firewalls have a shell script that powers them up and down as needed, and the script contains command line commands representing the rules. I would recommend to start out with a GUI tool, and then start reading about iptables. The man page is a good starting point. –  wolfgangsz Jun 20 '11 at 14:56
    
I also just recognized that Firestarter uses iptables, which is nice. But yes, I think it's always a good way to really know what's going on under the hood. Thanks again. –  High6 Jun 20 '11 at 15:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.