Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was considering deploying my web application on a Debian virtual machine. However, I want to lock it down as tight as possible (i.e. traffic in/out). I was wondering which, if any, port I needed to leave open to allow for updates.

share|improve this question
up vote 7 down vote accepted

All a default Debian install needs for updates is DNS traffic for name->address lookups (though you can remove this requirement by having the relevant names in your /etc/hosts file) and HTTP traffic to the servers listed in your sources.list file.

share|improve this answer
Thanks! I'll rephrase that for anyone (like me) that might not have caught all of that on the first read . . . Two ports are necessary for a default Debian install to get updates: the DNS lookup port (typically 53) and the HTTP port (typically 80). However, you can also disable the DNS lookup port if you put any needed domain names with their IP addresses in your /etc/hosts file. – Christopher Bottoms Mar 16 '10 at 22:09

Just about all apt-get sources use http, check your /etc/apt/sources.list.

You can also check the ruleset of iptables or ipchains to see if there is a rule that affects apt-gets usage.

share|improve this answer
Thanks so much! – Christopher Bottoms Mar 16 '10 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .