Debian Bug report logs - #353787
avahi-daemon: Automatically installed and listening on all interfaces.

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Aliban <aliban@gmx.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: avahi-daemon: Automatically installed and listening on all interfaces.

Date: Mon, 20 Feb 2006 23:22:29 +0100

Package: avahi-daemon
Version: 0.6.6-1
Severity: normal

I don't know why this pkg was installed in my testing. For sure I did not install it directly, maybe it was some strange dependency from something?

Anyway, this thing listens on all interfaces by default. I think this design is insecure. It should bind to localhost only (ok, this might not make 
sense for such a service) OR it should ask the user for the interfaces it binds to.

Please change the installer's  behaviour.

Thank you.


-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.15-1-k7
Locale: LANG=de_DE@euro, LC_CTYPE=de_DE@euro (charmap=ISO-8859-15)

Message #10 received at 353787-done@bugs.debian.org (full text, mbox, reply):

From: sjoerd@spring.luon.net (Sjoerd Simons)

To: Aliban <aliban@gmx.net>, 353787-done@bugs.debian.org

Subject: Re: Bug#353787: avahi-daemon: Automatically installed and listening on all interfaces.

Date: Tue, 21 Feb 2006 00:39:13 +0100

On Mon, Feb 20, 2006 at 11:22:29PM +0100, Aliban wrote:
> Package: avahi-daemon
> Version: 0.6.6-1
> Severity: normal
> 
> I don't know why this pkg was installed in my testing. For sure I did not
> install it directly, maybe it was some strange dependency from something?

No strange dependencies. You probably got it because rhythmbox recommends it. 

> Anyway, this thing listens on all interfaces by default. I think this design
> is insecure. It should bind to localhost only (ok, this might not make sense
> for such a service) OR it should ask the user for the interfaces it binds to.

Uhm, yeah, well, an mDNS daemon that only listens on lo is completely useless.
If you would looked a little bit further you might have seen that the daemon
runs as a unprivileged user, version 0.6.6-2 of the package even runs in a
minimal chroot environment, so it's actually quite secure by design.

> Please change the installer's  behaviour.

If you don't want it, purge it from your system. Afaik everything that doesn't
directly need it only recommends it. Closing this bug

  Sjoerd
-- 
We gave you an atomic bomb, what do you want, mermaids?
		-- I. I. Rabi to the Atomic Energy Commission

Message #23 received at 353787-done@bugs.debian.org (full text, mbox, reply):

From: Emilio Pozuelo Monfort <pochu@debian.org>

To: 353787-done@bugs.debian.org

Subject: avahi-daemon: Automatically installed and listening on all interfaces.

Date: Sun, 28 Feb 2010 19:06:33 +0100

Description: The GNOME Desktop Environment, with extra components
 This is the GNOME Desktop environment, an intuitive and attractive
 desktop, with extra components.
 .
 This package depends on the standard distribution of the GNOME desktop
 environment, plus a complete range of plugins and other applications
 integrating with GNOME and Debian, providing the best possible
 environment to date.


avahi-daemon is one of the extra components in the description. If you don't
want it, you can remove it and install e.g. gnome-desktop-environment (which
only depends on the GNOME desktop).

Emilio

Send a report that this bug log contains spam.