Re: FedoraWorkstation default firewall rules unsafe

2024-07-29 Thread Samuel Sieb
On 7/29/24 3:12 AM, Arthur Bols via devel wrote: On 28/07/2024 23:11, Samuel Sieb wrote: I wouldn't have this conversation if we had no firewall rules like arch or Debian, but we do. We even go as far as install and enable Firewalld by default. As far as I know Fedora is positioning itself as

Re: FedoraWorkstation default firewall rules unsafe

2024-07-29 Thread Kilian Hanich via devel
Am 29.07.24 um 09:58 schrieb Kamil Paral: On Sun, Jul 28, 2024 at 7:56 PM Kilian Hanich via devel wrote: Interesting position considering that Windows by default does block everything via its Firewall by default. And Windows normally isn't known to have great security defaults. On Windows, yo

Re: FedoraWorkstation default firewall rules unsafe

2024-07-29 Thread Arthur Bols via devel
On 28/07/2024 23:11, Samuel Sieb wrote: MDNS works by default.  Users don't need to open the port. It seems you are correct, due to the fact that ports 1025-65535 are open by default. I must've changed to the default zone to home for my network when I tried this years ago. Thanks for the corr

Re: FedoraWorkstation default firewall rules unsafe

2024-07-29 Thread Kamil Paral
On Sun, Jul 28, 2024 at 7:56 PM Kilian Hanich via devel wrote: > Interesting position considering that Windows by default does block > everything via its Firewall by default. And Windows normally isn't known > to have great security defaults. On Windows, you get an interactive popup prompt asking

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Samuel Sieb
On 7/28/24 3:49 AM, Arthur Bols via devel wrote: On 28/07/2024 11:33, Adam Williamson wrote: On Sun, 2024-07-28 at 10:25 +0200, Arthur Bols via devel wrote: Hi all, Yesterday, while assisting a user with connecting a printer, I noticed that the default firewall zone on Fedora Workstation is se

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Leon Fauster via devel
Am 28.07.24 um 13:20 schrieb Michael Catanzaro: On Sun, Jul 28 2024 at 11:37:15 AM +02:00:00, Arthur Bols via devel wrote: Aside that this does not contribute to the discussion at all, I believe it is reasonable to assume that the default firewall rules are strict enough to not open all ports a

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Kilian Hanich via devel
Am 28.07.24 um 13:20 schrieb Michael Catanzaro: On Sun, Jul 28 2024 at 11:37:15 AM +02:00:00, Arthur Bols via devel wrote: Aside that this does not contribute to the discussion at all, I believe it is reasonable to assume that the default firewall rules are strict enough to not open all ports a

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Kilian Hanich via devel
Am 28.07.24 um 16:36 schrieb Neal Gompa: On Sun, Jul 28, 2024 at 8:40 AM Chuck Anderson wrote: On Sun, Jul 28, 2024 at 12:49:51PM GMT, Arthur Bols via devel wrote: Sure. But why do those ports need to be open by default at all? What is the benefit of adding those extra 2 lines? Does it enhanc

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Neal Gompa
On Sun, Jul 28, 2024 at 8:40 AM Chuck Anderson wrote: > > On Sun, Jul 28, 2024 at 12:49:51PM GMT, Arthur Bols via devel wrote: > > Sure. But why do those ports need to be open by default at all? What is > > the benefit of adding those extra 2 lines? Does it enhance user > > friendliness? I doubt i

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Chuck Anderson
On Sun, Jul 28, 2024 at 12:49:51PM GMT, Arthur Bols via devel wrote: > Sure. But why do those ports need to be open by default at all? What is > the benefit of adding those extra 2 lines? Does it enhance user > friendliness? I doubt it, as users will still need to open ports for > e.g. slp or md

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Arthur Bols via devel
On 28/07/2024 13:20, Michael Catanzaro wrote: On Sun, Jul 28 2024 at 11:37:15 AM +02:00:00, Arthur Bols via devel wrote: Aside that this does not contribute to the discussion at all, I believe it is reasonable to assume that the default firewall rules are strict enough to not open all ports abo

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Michael Catanzaro
On Sun, Jul 28 2024 at 11:37:15 AM +02:00:00, Arthur Bols via devel wrote: Aside that this does not contribute to the discussion at all, I believe it is reasonable to assume that the default firewall rules are strict enough to not open all ports above 1024... That being said, it's an example, a

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Arthur Bols via devel
On 28/07/2024 11:33, Adam Williamson wrote: On Sun, 2024-07-28 at 10:25 +0200, Arthur Bols via devel wrote: Hi all, Yesterday, while assisting a user with connecting a printer, I noticed that the default firewall zone on Fedora Workstation is set to "FedoraWorkstation". This zone has ports 1025

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Arthur Bols via devel
On 28/07/2024 11:20, Björn Persson wrote: Arthur Bols via devel wrote: I often run dev servers that I assume are secure due to the default firewall settings This practice of blindly assuming that somebody else is protecting you from your own negligence is a common source of security breaches.

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Adam Williamson
On Sun, 2024-07-28 at 10:25 +0200, Arthur Bols via devel wrote: > Hi all, > > Yesterday, while assisting a user with connecting a printer, I noticed > that the default firewall zone on Fedora Workstation is set to > "FedoraWorkstation". This zone has ports 1025-65535 open by default > [0].  Is

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Björn Persson
Arthur Bols via devel wrote: > I often run dev servers that I assume > are secure due to the default firewall settings This practice of blindly assuming that somebody else is protecting you from your own negligence is a common source of security breaches. Björn Persson pgpyeh70G061F.pgp Descri