Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Also this:

  > sudo ufw deny 631
  > sudo ufw reload


reload is unnecessary if you make changes via the command line.


Maybe, but it’s good practice to verify that your reload is clean when you are actively working on it.


If by "working on it" you mean "changing configuration files"...

"Good practice" is never an argument btw. "It's good practice" means arguments exist, it is not an argument.


Being pedantic is rarely helpful, especially when the drive to correct people means you rush and neglect to be correct, as you did each time.

There’s nothing magic about configuration files. Any time you are making changes which could impact a system’s ability to restart, you want to test them when you’re ready to fix a problem rather than waiting for the next security patch, power outage, etc. It’s more likely to make mistakes when editing config files by hand but it’s not the only way, and since it’s so very easy to check the argument against doing so is very weak - being confident you haven’t made a mistake is worth the second it takes.

“Good practice” is an argument, but it’s at a different level. Any field has lessons drawn from collective experience, and while those are never perfect and change over time they are a convenient shorthand for things which usually aren’t worth spelling out in detail every time. We say it’s good practice to have backups because most people only need the reminder, not a three page discussion.


You're free to restart anything you want, of course. Reboot the whole machine every time you change anything, that way you'll be sure. I am not stopping you, and in some cases it can be useful to make absolutely certain.

I only pointed out that "ufw reload" is not necessary to make "ufw allow/deny/delete" take effect. Multiple people might not have known that, judging from the upvotes I got. And now I find I have to justify myself. Is that being "pedantic"? Am I the one "rushing"?

I don't see a reason why reload should be "good practice". If ufw or your config is buggy, it is very possible for the rules not to apply at next boot, when iptables is reset. If this is critical, reboot and do a test connection.


   deny 631
is not needed. The default is deny as soon as the firewall is enabled. Tested on Ubuntu 22.04.


You are right of course, but the default policy can be changed using "ufw default allow incoming", making "deny" necessary. You might do it on a laptop/workstation (in a network firewalled from the internet), though it doesn't sound like a great idea to me.


I prefer explicitness when it comes to configuring firewalls. Both for documentation and to guard against defaults changing underneath you.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: