Re: Starting services automatically after install
On Fri, Jun 01, 2012 at 08:23:20PM +0200, Jonas Smedegaard wrote:
> Debian goal is - as you probably know already - for packages to work out
> of the box. For daemons this means they are started by default.
>
> If a package (service or not) is insecure by default, it is a bug!
> Severity of such bugs vary - e.g. some may consider it insecure for a
> web server to publicly display a static page saying "It works!" while
> most probably won't.
>
> You can override the default of daemons using policy.d.
>
> What I do for chroots - which you can adapt to your own personal needs,
> is to install the package policyrcd-script-zg2 and add the attached
> config file as /usr/local/sbin/policy-rc.d .
(Snipped code)
This is quite a bit of work from the administrator's point of view. And, as
much as we would not like to admit it, no software is "secure by default".
Security isn't a binary function. I wouldn't mind so bad if the services
listened to localhost by default, and not on external interfaces. This
would allow me to make configuration changes, and continue to reload the
service, testing locally, until I'm satisfied it can be for the general
public, or whomever my customers are.
Enabling services on external interfaces by default is indeed a bug, IMO,
especially things like SSH, DHCP, SMTP or Bind (which has a long history of
security problems).
--
. o . o . o . . o o . . . o .
. . o . o o o . o . o o . . o
o o o . o . . o o o o . o o o
Reply to: