OpenSSH service binding to all interfaces in Kali Linux live image

Kali Linux’s default installation ships with the OpenSSH server package installed but the daemon is disabled until a user manually starts it. When the service is activated, it listens on all IPv4 and IPv6 addresses (0.0.0.0/::) unless explicitly bound to a specific interface. The nftables firewall is inactive on a fresh install, providing no per‑interface filtering, and NetworkManager obtains addresses via DHCP without applying interface‑specific restrictions.

An open design question remains whether the live‑image should include a hardened network profile that disables non‑essential services by default, leaving users to enable only what is required. This ambiguity can lead to accidental public exposure of services. What criteria should define a minimal, secure default network profile for Kali Linux? Should the project ship a pre‑configured profile that disables non‑essential services? How can security hardening be balanced with the flexibility needed for legitimate penetration‑testing workflows?