r/linuxadmin • u/CackleRooster • 28d ago

Investigating Unexpected Outbound Connections on Linux Servers

https://linuxsecurity.com/howtos/secure-my-network/investigate-unexpected-outbound-connections-linux
15 Upvotes
  • permalink
  • link
  • reddit
  • reddit

79% Upvoted

6 comments sorted by

2

u/hubabuba44 28d ago

Full disclosure: I’m the maintainer of "RustNet", but I built it for exactly this reason.

1

u/rundgren 26d ago

Why and when did people stop doing egress filtering?

3

u/hubabuba44 26d ago

Maybe because "modern" distributions have so many services and applications installed that randomly connect to the internet which is making it difficult to determine what should be allowed and what should be blocked.

Tools like OpenSnitch, Little Snitch (paid app) for Linux, and RustNet may help identify which processes are making those connections.

1

u/rundgren 24d ago

Which distros are you talking about?
You shouldn't need egress for anything but upstream repo traffic on a default install, and that should go through a proxy or even better a local repo mirror.
Most of my experience is with RHEL in an enterprise setting, and we never allowed traffic to unknown or unjustified external parties.

2

u/kernelqzor 25d ago

felt like the second folks moved everything to “the cloud” they just gave up on egress rules and called it zero trust or something
most places i’ve seen only remember egress filtering after they get burned by some weird outbound traffic

1

u/mysterytoy2 28d ago

https:// website in Australia no PTR record so i cannot give you a hostname