During installation, tasksel gives you the option of including "standard system
utilities". This group includes nfs-common and rpcbind, which, post
installation, automatically launch daemons that listen on ports. Debian's
default iptables configuration after installation is to allow all connections.
This is a security concern.

There's no indication to the user that selecting standard system utilities will
do this. Having a permissive firewall policy by default is fine, provided that
no open ports are running by default as well, but this is not the current
situation.

Possible solutions:
1. Do not include these packages in the task
2. More restrictive default firewall policy that will protect these ports until
the user decides to make them available
3. Keep as is, but notify the user that the included packages will listen for
connections upon selection

Hi,

Michael Rose <mdrose@zoho.com> writes:

That is the current plan for Debian 9, see [1] and [2].

Ansgar

  [1] <https://lists.debian.org/debian-devel/2015/05/msg00089.html>
  [2] <https://bugs.debian.org/788702>

Quoting Michael Rose (mdrose@zoho.com):

If these packages are "Priority: standard", they're included in the
"standard" task. Tasksel is not really in position to raise a judgment
about the behaviour of installed packages.

This bug report should eventually be reassigned against nfs-common.