Blacklist uncommon network protocols

Development
21

Merged, thanks! :slight_smile:

1 Like
22

By @onion_knight.

23

Merged.

24

I think it would be a good idea to blacklist network file systems such as NFS and SMB as well. These can be blacklisted with

install nfs /bin/true
install cifs /bin/true

SMB has had plenty of security vulnerabilities in the past and was one of the main ways the WannaCry ransomware was spread.

1 Like
25

I donā€™t mind becuase I donā€™t use either myself but in the case of nfs it is the only protocol for sharing files from the guest with a Linux host in event of running MS Windows for compatibility reasons.

2 Likes
26

Would only have been exploitable for users who choose to use these protocols? Or was there a security risk for users who have nothing to do with these protocols?

Concern: I donā€™t think we should blacklist protocols which cannot be abused to autoload that only make it more difficult for users who choose to use these.

2 Likes
27

If you have the software installed to use them, youā€™ll likely be at risk.

Iā€™m not sure if it would be possible to exploit these without the needed packages installed (e.g. the samba package in the Debian repos).

1 Like
28

In such cases we need to tap into external knowledge by asking elsewhere. Just making things more difficult without knowing if thereā€™s a point seems wrong.

2 Likes
29
1 Like
30

Wouldnā€™t that spam whatever is getting the notification with pointless errors?

1 Like
31

Better to fail and see an error message. Even if spamming. In theory. We donā€™t know if itā€™s spamming or any error message at all. /bin/false only increases chances that there will be a visible error message. Not so good to fail and not see any error message.

1 Like