Hacker News Reader

Comment by rbanffy | Hacker News Reader

The only thing I can say against Debian is that it tends to start new server software immediately after install, before I have a chance to configure it properly. Defaults are sane for most packages, but, still, it scares me a little. In that I like the Red Hat approach of installing and leaving it off until I decide to turn it on.

View on HN

It is a well-known issue with probably less well-known solutions, cf. <https://unix.stackexchange.com/questions/723675/debian-ubunt...>

  echo exit 101 > /usr/sbin/policy-rc.d
  chmod +x /usr/sbin/policy-rc.d

I think this is the recommended way to avoid autostarting services on Debian.

Good pointer. I remember learning it, and then forgetting it. Probably more than once.

Still should be the default behavior.

Just have sane firewall rules and you are good. E.g. if I install openssh-server and it auto starts, it doesn't make it out of my machine because my nftables does not allow inbound on port 22. It's just knowing the default behaviour and adjusting your practices for it.

Aren't firewall rules part of the "configuration" the OP talked about?

No, because you can install and configure the firewall before you install package X. (without knowing anything about X, your firewall defaults can just prevent X from doing anything)

But you can't (easily) configure package X itself before you install it; and after you install it, it runs immediately so you only get to configure it after the first run.

That is a workaround for a ridiculous issue.

A sane firewall won't protect you from privilege escalation from a local attacker. While unlikely, this is one more breach that could be exploited.

Debian bundles AppArmor profiles for most services. This will prevent an attacker from accessing outside the perimeter drawn by the AppArmor profile.

This is the "you're holding it wrong" response to a clear design issue.

Reply on news.ycombinator.com