Hacker News Reader

Comment by bitwize | Hacker News Reader

There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide. Still the only OS I'd trust hooking directly up to the internet with a web server or something, without a firewall of some sort in between.

I got into OpenBSD again when I bought a new, cheap potato to play with -- an HP thin client PC I scored off eBay for $25. The super-lightweight candidate operating systems I tried for it -- AROS and Haiku -- both struggled with its eMMC controller and couldn't even find a volume to install to; the same, oddly, was true of NetBSD. OpenBSD found it just fine.

View on HN

> There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide

It's nothing to do with OpenBSD though, is it. I swear it's ingrained to people to just unconsciously compliment OpenBSD's security and spread the myth.

Put fail2ban on a public facing webserver or setup any kind of honeypot and enjoy the exact same thing.

Why would you turn off the firewall?

Because you just have services that are already "internet hardened" running?

Sounds like a poor reason to turn off your firewall

Can't see a reason to close ports with firewall on which there is nothing listening anyway.

The best defence, IMO, is not to have the thing if you don't need the thing. Having to remember about it all the time sometimes prevents the work from getting done.

You may want to not send back the "unreachable port" ICMP messages that are the default behavior for ports on which there is nothing listening.

The traditional configuration for a server or router is to block in the firewall all the unused ports, which means that ICMP responses will not be sent back, with the exception of the range of ports that are normally used by the "traceroute" utility.

Unfortunately, there are also stupid people who block in the firewall even the traceroute ports, which makes more difficult the diagnosing of any network problem.

What would the firewall do in this case exactly? It's just a webserver, so you'd normally allow all http/https traffic through anyway.

Reply on news.ycombinator.com