up vote 1 down vote favorite
share [g+] share [fb]

I was considering deploying my web application on a Debian virtual machine. However, I want to lock it down as tight as possible (i.e. traffic in/out). I was wondering which, if any, port I needed to leave open to allow for updates.

link|improve this question
100% accept rate
feedback

2 Answers

up vote 3 down vote accepted

All a default Debian install needs for updates is DNS traffic for name->address lookups (though you can remove this requirement by having the relevant names in your /etc/hosts file) and HTTP traffic to the servers listed in your sources.list file.

link|improve this answer
Thanks! I'll rephrase that for anyone (like me) that might not have caught all of that on the first read . . . Two ports are necessary for a default Debian install to get updates: the DNS lookup port (typically 53) and the HTTP port (typically 80). However, you can also disable the DNS lookup port if you put any needed domain names with their IP addresses in your /etc/hosts file. – molecules Mar 16 '10 at 22:09
feedback
up vote 2 down vote

Just about all apt-get sources use http, check your /etc/apt/sources.list.

You can also check the ruleset of iptables or ipchains to see if there is a rule that affects apt-gets usage.

link|improve this answer
Thanks so much! – molecules Mar 16 '10 at 21:50
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.