Ubuntu security documentation

poor code quality， such ascomplexity， serving websites to the internet)， Ubuntu has followed a “No Open Ports”policy. By default， you shouldn’t enable programs with such problems by default. Sign-off process The Ubuntu Technical Board and a member of the Ubuntu core developers’ securityteam must approve any software that listens on or is advertised to the networkin the default installation. Exceptions to the “No Open Ports” policy Notable exceptions to the “No Open Ports” policy are listed below. Ubuntu Desktop Exceptions for Ubuntu Desktop systems include network infrastructure servicessuch as a DHCP client and the Avahi mDNS/DNS-SD daemon. These services allow the system to communicate with other devices on a networkwith minimal manual configuration. The system needs a DHCP client to receiveincoming communication from a router to automatically obtain an IP address whenconnecting to a network. An mDNS/DNS-SD daemon is needed for device discoveryover a network when using ZeroConf technologies. Ubuntu Server When installing Ubuntu Server， as their installation requiresexplicit user action. Automatically exposing global machine information at the IP network level isacceptable. This includes the network controller’s MAC address。

via the Avahi mDNS/DNS-SD daemon). Because these services might beuntrustworthy or potentially dangerous， you can select specific services to installbeyond the defaults， Back to top No open ports An “open port” is a network port bound to a service and actively listening forincoming connections or packets. Exposing open ports on untrusted networks poses a security risk if thelistening service has a vulnerability or is misconfigured. Since Ubuntu 6.06 LTS (Dapper Drake)， use the -p flag to see which process islistening on each of the open ports: sudoss-utlnp | grep-vE 127\.0\.0|\[::1\] ， applications that use detected servicesmust: Always clearly separate local (or locally configured) trustworthy servicesfrom automatically detected remote services. Never automatically communicate with detected services without an explicituser request. Offer a discoverable way to disable the presentation and usage ofautodetected remote services. The default Ubuntu Server installation must not detect any services offered byother computers in the network. Additional security considerations A process included in the default Ubuntu installation that accepts networkpackets must be privilege-confined. Any potential arbitrary code executionvulnerability in the process shouldn’t be able to access user data or othersystem processes. Typically， or inadequate upstream security responseprocesses. These issues make identifying and fixing vulnerabilities moredifficult. Therefore， and availability of network-facing services. For example， this means running the process under a system userID， withonly rare exceptions. Guidelines for network services exposed by default While default Ubuntu installations keep exposed network services to a minimum， such as Apache HTTP Server and OpenSSH server. Theseservices are often necessary for the server to perform its function (forexample。

IP address，local hostname， possibly with restricted group memberships that don’t grant root-equivalentprivileges. Software that offers network services may have other security problems， a new installation should have no listening network services， weallow some exceptions. These are limited to services that substantially improvethe out-of-the-box user experience. All such network services must comply with the following guidelines. Exposing local information to the network A default Ubuntu installation must not expose any application-level data to thenetwork unless the user explicitly requests it using a clear and understandableinterface. Note Packages not included in the default installation may automatically exposeapplication-level data to the network， so the installer provides an optionto include them in the default installation. Ubuntu Cloud Images Ubuntu Cloud Images generally includenetwork infrastructure services for the cloud and OpenSSH server configured bythe cloud provider to allow the client to access the machine. Identifying open ports Use the ss utility to identify open ports on a system: ss-utln | grep-vE 127\.0\.0|\[::1\] With sudo permissions， aDHCP client broadcasts the device’s MAC address during DHCP discovery. Package or distribution upgrades must not expose any information not previouslyexposed. Detecting and using remote services The default Ubuntu Desktop installation automatically detects services offeredby other computers on the network and presents them to the user (for example，。