Close ports without UFW

Ports are closed, unless something is listening on them. There is the sshd by default, a decision I don't agree with. Of course, if you install more servers, you're opening more ports.

I believe that verification error thing will go away if you just wait.

Unfortunately no. I tested the ports condition and there were a couple of them opened (22 and a couple of others). Like, OPENED! In the RED! That just made me angry ya know, because all my ISP has to do is just have a bot waiting ffor any connection to happen and attack those ports.
I have been trying to find a way around it, but I have no resources (having another computer running a shared wifi connection, with protection already in place would be good, but like I said, no resources).
I really would like to know why ufw (which is less than 1 megabyte) was left out. Is it absolutely necessary? maybe not, but it wouldn't hurt. And for me, yes its necessary.

However, is it possible to close those ports without ufw? What services are running in a Trisquel default installation that leave open ports? If I disabled those before I connected to the internet maybe I could have the ports closed....

I still don't understand why you think you need a firewall.

You don't need a firewall.

When there are no programs listening and reading information send through network ports, it doesn't matter what information is send to your computer. The information will just get ignored, wherever it's malicious or not. It won't even be read.

Now, by default in Trisquel there are several programs (called "services") that indeed listen and read messages send through network ports. These are the:

1. OpenSSH server, used for remote access to your computer
2. CUPS server, used for access to printers
3. SMB server, used for file sharing with Windows operating systems
4. Dnsmasq server, used for something that has to do with DNS

When you type "ss -ln" you'll see all ports on which services listen on:

1. OpenSSH listens on port *:22
2. CUPS listens on port 127.0.0.1:631
3. SMB listens on ports *:139 and *:445
4. Dnsmasq listens on port 127.0.0.1:53

First, notice that CUPS and Dnsmasq ports start with 127.0.0.1. This means that they will only listen on their ports, if the connection is send by your computer. Messages from other computers will be ignored.

Then there are OpenSSH and SMB which ports start with *. This means that they will listen to messages send by other computers. But that doesn't mean your computer will get cracked. These programs were written by many people who understand and are concerned with computer security.

One thing you should keep in mind is, if someone knows your username, password and IP-address, he may be able to access remotely your computer through SSH.

There's the possibility that there's might be a security hole in OpenSSH or SMB. A hole of which only bad people know. If that concerns you, then you should just stop those two services. You don't need a firewall.

I also stop CUPS, just because I don't use it. To stop those services, you do:

echo "manual" | sudo tee /etc/init/cups.override
echo "manual" | sudo tee /etc/init/smbd.override
echo "manual" | sudo tee /etc/init/ssh.override
sudo stop cups
sudo stop smbd
sudo stop ssh

Now if you do "ss -ln", you'll probably see only dnsmasg listening on port 127.0.0.1:54. I don't know if dnsmasg is useful for me. It doesn’t listen to other computers anyway, so I leave it be.

When I want to start the SSH server, I do "sudo start ssh". When I finish, I do "sudo stop ssh".

Your concerns arise from you not understanding. I suggest you try to learn how computers and GNU systems work. I suggest to you the website http://codeschool.org/. There you'll find video lesson on programming, operating systems and how computers work. The lessons that most closely concern this topic are:

• "Hardware and operating system basics"
• "The Internet"
• "Unix system calls"

PS: In tutorials I've seen the firewall is configure to only deny some or all incoming connections. That's all it does. This doesn't give you more security than simply disabling services listening on ports. If you run a malicious program, it can just use an outgoing connection, which makes more sense in any case.

Firewall is not a "magical solution for all problems". But it certainly helps.

It makes you harder to detect on the web (stops wannabe hackers from messing with you).
It makes a log of what happens in your network.
It prevent that a program connects to a outside server without you wanting it (at least makes it more difficult).

I believe and maintain that Trisquel should come with ufw at least. Gufw would be good too.

And I would like to use a physical firewall, but at the moment I cannot. =(

> You are assuming that the malicious program has root privileges. That is often not the case.

It definitely is the case. It's very typical to run a one-user system. When you install a program on a system such as Trisquel, you most often do it with root privileges. But even in cases you run the malicious program without first installing it as root, it's typically done by the same user who has sudo privileges. The next time this user enters his password to gain root privileges by a sudo command, the malicious program can find out the password.

> Telling people not to use a firewall is telling them to undermine their security.

What I'm trying to say to people is, that installing a firewall on your computer to block incoming connections ports such as 22 (SSH) or similar is meaningless.

But I do care to learn of a good use case, where a firewall installed on my one-user system can give me significant protection.