"Workstation" Product defaults to wide-open firewall

Bastien Nocera bnocera at redhat.com
Mon Dec 8 09:48:40 UTC 2014



----- Original Message -----
> Hi,
> 
> I just happened to look at the firewalld default settings, and I was not
> amused when I noticed this:
> http://pkgs.fedoraproject.org/cgit/firewalld.git/tree/FedoraWorkstation.xml
> >  <port protocol="udp" port="1025-65535"/>
> >  <port protocol="tcp" port="1025-65535"/>
> This "firewall" is a joke! ALL higher ports are wide open!
> 
> There had been a prior discussion on this list where they wanted to disable
> the firewall entirely. We told them that that's a horrible idea (which it
> is, of course!). But the result is that they implemented this "solution"
> which is almost entirely as bad, and which additionally gives users a false
> sense of security, because a "firewall" is "enabled" (for a very twisted
> definition of "enabled").
> 
> IMHO, this is a major security issue that MUST be fixed. It also shows what
> horribly bad an idea per-Product configuration is.

This was discussed, and implemented in the open, and I sent the details of the 
feature, and how it would be implemented to the fedora desktop list, as is
customary for Workstation features.

> Yet another reason why you should NOT use "--product=workstation" to upgrade
> your F20 to F21 (ALWAYS use "--product=nonproduct"). Installing the
> "Workstation Product", or upgrading to it, will leave you with a totally
> insecure system.

There are no services listening on upper ports enabled by default, all the
sharing services in Fedora will require actual enabling. See:
http://www.hadess.net/2014/06/firewalls-and-per-network-sharing.html

Next time, don't be 6 month late if you're going to be flippant.

Cheers


More information about the devel mailing list