[opensuse] Re: Interactive Firewall Needed
On Thu, 07 May 2009 08:36:32 -0500, L. V. Lammert wrote:
1) IF an applicaiton needs an open port, it is opened upon *INSTALLATION*, not use!
Um, no....Apache doesn't set up a listener when it's installed, it sets it up when it starts. Jim -- Jim Henderson Please keep on-topic replies on the list so everyone benefits -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
At 03:57 PM 5/7/2009 +0000, Jim Henderson wrote:
On Thu, 07 May 2009 08:36:32 -0500, L. V. Lammert wrote:
1) IF an applicaiton needs an open port, it is opened upon *INSTALLATION*, not use!
Um, no....Apache doesn't set up a listener when it's installed, it sets it up when it starts.
Agreed. Apache isn't an 'application', however, as the OP was describing. Lee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Thu, 07 May 2009 11:07:16 -0500, L. V. Lammert wrote:
At 03:57 PM 5/7/2009 +0000, Jim Henderson wrote:
On Thu, 07 May 2009 08:36:32 -0500, L. V. Lammert wrote:
1) IF an applicaiton needs an open port, it is opened upon *INSTALLATION*, not use!
Um, no....Apache doesn't set up a listener when it's installed, it sets it up when it starts.
Agreed. Apache isn't an 'application', however, as the OP was describing.
Fine, Pan also doesn't open a port at installation time. It opens it when the application is running. I don't know of a single application that, upon installation, a port is opened even though the application is not running. Jim -- Jim Henderson Please keep on-topic replies on the list so everyone benefits -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
At 04:14 PM 5/7/2009 +0000, you wrote:
On Thu, 07 May 2009 11:07:16 -0500, L. V. Lammert wrote:
At 03:57 PM 5/7/2009 +0000, Jim Henderson wrote:
On Thu, 07 May 2009 08:36:32 -0500, L. V. Lammert wrote:
1) IF an applicaiton needs an open port, it is opened upon *INSTALLATION*, not use!
Fine, Pan also doesn't open a port at installation time. It opens it when the application is running.
Don't confuse 'running' with 'installing'. Any application that requires an open port to function properly has either an installation script that configures the system properly, or a readme that states what must be done post installation. In both cases, the user is NOT involved, and in most business operations, is prevented from such operation by corporate policy. Lee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Thu, 07 May 2009 13:18:32 -0500, L. V. Lammert wrote:
Don't confuse 'running' with 'installing'. Any application that requires an open port to function properly has either an installation script that configures the system properly, or a readme that states what must be done post installation.
We're not talking about the same thing here, Lee. An application that requires access to the internet surely should make that known during installation. However not all application developers do things that way. So having a piece of software that sits - if you will - between the application and the network and alerts the user when the application is making a request to access non-local resources is what this discussion is about. I didn't have to *configure* Pan to connect to a server using the server's port 119 using a high dynamically allocated port (in fact, for applications that do that, there is no configuration, the app just does its thing). But if that connection is something I didn't expect, the only way I have to find that out is to run Wireshark and watch the traffic and see if there are any abnormalities. Which means I need that kind of expertise. Fortunately, *I* do have that expertise, so if I'm interested, I can use a tool like Wireshark and learn what I need to know. But my wife isn't a LAN analysis expert and has no idea how to use Wireshark. But if she opens an application that makes an unexpected connection somewhere, wouldn't it be a good idea to log that somewhere and at least let the user know that their system might just have been compromised? Or does it make more sense to let the software that managed to get itself installed (through whatever means) to just continue running silently in the background? It seems to me that a user who wants to be kept informed about what their system is doing without getting an advanced degree in Linux Systems Administration should have an option to do that. Jim -- Jim Henderson Please keep on-topic replies on the list so everyone benefits -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
participants (2)
-
Jim Henderson -
L. V. Lammert