Earl:

...

I am looking at the documentation of the new firewalld service in CentOS

7.

You can check out the following document https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht

ml/Security_Guide/sec-Using_Firewalls.html

That is the document I read when I referred to reading the documentation on the firewalld service.

Neil

-- Neil Aggarwal, (972) 834-1565 We lend money to investors to buy or refinance single family rent houses. No origination fees, quick approval, no credit check.

Tom:

I thought we were supposed to be moving forward

That is my thought exactly. This is a step backwards.

I guess I will disable firewalld and go back to iptables.

Thanks, Neil

-- Neil Aggarwal, (972) 834-1565 We lend money to investors to buy or refinance single family rent houses. No origination fees, quick approval, no credit check.

On Sat, 2014-08-09 at 09:45 -0500, Valeri Galtsev wrote:

Systemd, firewalld... Linux from what formerly was "UNIX-like" becomes "MS Windows-like". This is what you will hear from everybody fleeing Linux (I for one started gradually moving servers to FreeBSD a while back).

Snap ! (meaning in colloquial English, I agree exactly).

I read someone's supplied link to Red Hat's firewalld documentation. As I looked at the confusing collection of zones I instantly remembered all the problems I had with Windoze especially trying to understand the logic of Windoze's own firewall/Internet zones. I hated and despised that crap and used a superior third-party firewall instead.

I am a heavily reliant user of IP Tables. I would not like to lose it. Yet someone at Red Hat decided in C7 it would be replaced by a M$ lookalike product. OK, one may remove it and install IPT. Exactly which users demand IPT's replacement by firewalld (Microsoft, Inc. ?)

Firewalld is so much like the confusing and time-wasting M$ crap, fit only for brain dead morons, instead of those with functioning brains. The Windoze reminiscence was a very unpleasant feeling.

I fled the M$ crap and found a delightful refuge in Centos. The difference from Windows was inspiring and liberating. It was truly wonderful, and still is on C5 and C6. I wished I had abandoned Windoze 20 years earlier.

If Red Hat want to sell the company to Micro$oft or gradually replace excellence with M$-style crap, I sadly would go elsewhere, probably to OpenBSD.

What is the point in gaining good Linux skills, if the Red Hat family is going to emulate M$ crap? Sorry, I absolutely loath Windoze.

On 08/09/2014 09:45 AM, Valeri Galtsev wrote:

On Sat, August 9, 2014 9:15 am, Neil Aggarwal wrote:

...

Tom:

...

I thought we were supposed to be moving forward

That is my thought exactly. This is a step backwards.

I guess I will disable firewalld and go back to iptables.

Systemd, firewalld... Linux from what formerly was "UNIX-like" becomes "MS Windows-like". This is what you will hear from everybody fleeing Linux (I for one started gradually moving servers to FreeBSD a while back).

You and 4 other guys are moving things from Linux to FreeBSD.

The rest of the world is moving things from UNIX and Windows to Linux.

CentOS-7 rebuild RHEL sources and most all of the "important" Enterprise Linux things are moving to RHEL.

RHEL runs the stock exchanges, the banks, etc.

Free BSD is fine and people can use it if they like ... but if you want real Enterprise grade software, it needs to be RHEL based, that is just the way it is.

Keep in mind that EL 7.0 is a 'dot zero release' and some of the features need work. It works for the majority of use cases, but some features will need to be enhanced, and Red Hat will enhance it. When they do, we will build the source code and it will be in CentOS.

On 11.08.2014 15:43, Tom Bishop wrote:

...

You and 4 other guys are moving things from Linux to FreeBSD.

The rest of the world is moving things from UNIX and Windows to Linux.

CentOS-7 rebuild RHEL sources and most all of the "important" Enterprise Linux things are moving to RHEL.

RHEL runs the stock exchanges, the banks, etc.

Free BSD is fine and people can use it if they like ... but if you want real Enterprise grade software, it needs to be RHEL based, that is just the way it is.

Keep in mind that EL 7.0 is a 'dot zero release' and some of the features need work. It works for the majority of use cases, but some features will need to be enhanced, and Red Hat will enhance it. When they do, we will build the source code and it will be in CentOS.

I hear you Johnny, I'm a big RH fan, but there is several things that they have shifted to in RHEL 7 that just chafes a little.

I am dual hat guy, network and IS and when iptables with firewalld, at a minimum I would like the ability to be able to accomplish the same things I accomplished with iptables. I read about firewalld the pros and cons and I understand the shift and reason.

But I do have heartburn when they call something a "firewall" and you cannot drop all the packets. It's not like they didn't know about it since I read about it in fedora and it's not clear if it will be addressed. There are lots of use cases where I want to control all of the packets coming and going from a box, I see this becoming more so moving forward.

Hopefully this will be addressed in a future release, trying to figure out where I can go to now and keep up to date with the latest firewalld info, just to stay clued in.

While I am also disappointed with firewalld I think the whole situation is not as terrible as people claim it is after all you can easily go back to iptables as it was in CentOS 6:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/htm...

It's strange that people threaten to go FreeBSD simply because the defaults are not to their liking. Not exactly a rational way to look at things.

Regards, Dennis

On Mon, August 11, 2014 8:28 am, Johnny Hughes wrote:

On 08/09/2014 09:45 AM, Valeri Galtsev wrote:

...

On Sat, August 9, 2014 9:15 am, Neil Aggarwal wrote:

...

Tom:

...

I thought we were supposed to be moving forward

That is my thought exactly. This is a step backwards. I guess I will disable firewalld and go back to iptables.

Systemd, firewalld... Linux from what formerly was "UNIX-like" becomes "MS Windows-like". This is what you will hear from everybody fleeing Linux (I for one started gradually moving servers to FreeBSD a while back).

You and 4 other guys are moving things from Linux to FreeBSD.

You only spotted 4 _last_ guys running away to UNIX. The rest fled quite a while ago. Some 7 years ago the guy looking for new system to move his servers from Linux to called Linux "Lindoze". Don't explode on me, I held myself for several posts and didn't repeat that. But he was so much cleverer than I am: already then he realized Linux is becoming "MS Windows-like" system.

Again, I have to repeat: I was happy with Linux for over decade and a half. However, the changes are such that at least my server are moving (some of them have moved already) away from Linux.

The rest of the world is moving things from UNIX and Windows to Linux.

It takes quite a self confidence to say "the whole world is doing..." and then describe one's own opinion. Well, part of the World is doing good thing: the ones who move away from Windows. Moving from UNIX... I better hold my opinion about this.

CentOS-7 rebuild RHEL sources and most all of the "important" Enterprise

Linux things are moving to RHEL.

RHEL runs the stock exchanges, the banks, etc.

Which of the banks and stock exchanges are you working for? Never mind. You may be quite right as some on them which for long time used M$, are likely moving away, and Linux is definitely much better choice that M$, and easier step than from M$ to, say, FreeBSD...

Free BSD is fine and people can use it if they like ... but if you want

real Enterprise grade software, it needs to be RHEL based, that is just the way it is.

This may be about the definition of what one calls "Enterprise" system.

1. The system that runs securely for multiple Months without need for reboot, without kernel Oopses... Even if you need some effort to install and configure what you need, and have be somewhat careful in choice of hardware, but then you get ultimately reliable box. I may be off canonical definition, but this would be my choice of servers I run for the Departments I support.

2. The system that is nice replacement of M$ system, easy to install, which runs millions of names of great software - without need to put much effort in building or God forbid porting to your system. And even though I do not call this "Enterprise" and do not prefer this for servers, I do prefer this system for workstations for my users. That is why I'm still on this mail list. Still maintaining public CentOS Linux and Ubuntu mirrors (and will add Debian mirror as another sysadmin who was maintaining Debian mirror left our University). So, this is why you still can hear me as one of the 4 fleeing [servers] from Linux.

Keep in mind that EL 7.0 is a 'dot zero release' and some of the

features need work. It works for the majority of use cases, but some features will need to be enhanced, and Red Hat will enhance it. When they do, we will build the source code and it will be in CentOS.

And it looks like finally I start realizing that if I take what you said almost literally, you may be right. What I mean is: I'm sysadmin working for a couple of hundreds of scientists. I chose UNIX for servers. One person. My users - scientists - would chose Linux for their goals (they mostly choose MacOS actually for their laptops...). 200 people. (They fled M$ over 10 years ago...) In this statistics 200:1 you are right. Right?

In any case the "Enterprise" definition may be different depending on what you do: run the server for 200+ users or the server for 3 users (yourself, you spouse and a good friend next door). Sorry, I used hyperbole here, do not take it literally ;-)

Valeri

---

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

On Mon, Aug 11, 2014 at 11:23 AM, Valeri Galtsev galtsev@kicp.uchicago.edu wrote:

...

You only spotted 4 _last_ guys running away to UNIX. The rest fled quite a while ago.

On Mon, 2014-08-11 at 12:53 -0400, BC wrote:

I wasn't aware that this was a forum for whining that upstream's vision of a system didn't match one's own.

Stating one's dread of having imposed as a standard, a firewall that can not control outgoing packets and has dumbed-down Micro$oft-like 'zones' and the possible future removal of IP Tables from the very much admired Centos version of RHEL, is probably a desperate call for sanity to prevail at Red Hat.

The imposition of what appears to many of unfinished software rather than a genuine finished improvement does suggests faulty reasoning upstream. Upstream's people take more notice of this list since the Red Hat 'take-over' / 'intervention' / 'involvement' in Centos. The ordinary Centos fan has little ability to reach any of the decision makers at Red Hat. This list is probably the easiest and best method.

It is better if one articulates one's concerns on here rather than ignoring what appear to be fundamental mistakes in the composition of much appreciated software.

We care because we genuinely like Centos.

On 8/11/2014 11:36 AM, Jonathan Billings wrote:

On Aug 11, 2014, at 1:16 PM, Always Learning centos@u62.u22.net wrote:

...

Stating one's dread of having imposed as a standard, a firewall that can not control outgoing packets and has dumbed-down Micro$oft-like 'zones' and the possible future removal of IP Tables from the very much admired Centos version of RHEL, is probably a desperate call for sanity to prevail at Red Hat.

'FirewallD' doesn't replace 'iptables' except in the sense of activated system services, not the core firewall functionality. FirewallD just builds and modifies iptables rules. If anything, FirewallD might make it easier to migrate to nftables (a potential replacement for iptables) when that becomes mature[1]. But that's nowhere on the radar right now.

If you don't like FirewallD, don't use it. It's just a tool to make managing your firewall easier, and allowing the OS and user to dynamically load rules depending on certain logic. It replaces the monolithic /etc/sysconfig/iptables file and the 'iptables' systemd unit. No one is talking about removing the core netfilter technology behind 'iptables'.

Just reading this thread makes me wonder if people criticizing FirewallD actually even tried it or even read the documentation!

1.) http://netfilter.org/projects/nftables/

-- Jonathan Billings billings@negate.org

Thank you Jonathan for injecting a little sanity. What I was reading just wasn't making sense to me.

I have not even started to digest 7. What is the proper method of getting back to an industrial strength firewall under 7? Does one disable FirewallD and install iptables or does iptables install on top of FirewallD? You are making it sound like FirewallD can act as a management tool for iptables.

On Mon, Aug 11, 2014 at 08:25:46PM +0100, Always Learning wrote:

...

FirewallD just builds and modifies iptables rules.

Why do I need more complexity together with more learning time and more effort and conversion of existing rules ? IP Tables works fine. Absolutely no complaints.

Do you run virtual machines on any of your systems? The required dynamic rules are the primary use case it solves very well. It also works as a desktop firewall somewhat less ideally. Since it has an API, it may someday be a full-featured dynamic server firewall. But, otherwise, it's probably not what you want for anything complicated -- and mostly harmless for anything simple.

On 08/12/2014 07:25 AM, Always Learning wrote:

On Mon, 2014-08-11 at 14:36 -0400, Jonathan Billings wrote:

...

'FirewallD' doesn't replace 'iptables' except in the sense of activated system services

I just love using sv ipt ... (my abbreviations for service iptables). Not keen on another 'service' duplicating my manual and automated efforts.

...

FirewallD just builds and modifies iptables rules.

Why do I need more complexity together with more learning time and more effort and conversion of existing rules ? IP Tables works fine. Absolutely no complaints.

...

If anything, FirewallD might make it easier to migrate to nftables (a potential replacement for iptables) when that becomes mature[1].

Think I would prefer to use the nftables without a Lindoze wrapper.

I think all the various folk that have learned to manage iptables have forgotten the pain and arcane syntax and gotchas that trap you when you first start. So now you have your favourite script that "just works" and you do not want to change.

Fine, that is an option available to you - take the option and move on. For others, those new to Linux, and many that use things like webmin the new firewalld may be an adequate solution. Sure it feels a little windoze like, but please give it a rest.

For better or otherwise the CentOS upstream provider has made a change and thus that is the new world for any that want CentOS-7. It is a done deal, perfect? unlikely, I for one have seldom needed or put in place an outgoing firewall, in fact cannot recall ever needing to. I have set up dozens of servers on multiple continents and always have an incoming firewall in place, along with selinux enforcing (since CentOS-6).

Will shortly start installing CentOS-7, thus far, only done live boot of gnome and kde disks to have a look, and look forward to seeing how it plays.

Would appreciate more constructive posts on the list - please

Am 13.08.2014 um 15:16 schrieb Timothy Murphy:

I'm a bit surprised no-one has mentioned shorewall. I'm using it on two tiny home servers, one under CentOS-6 and the other CentOS-7. Basically, this is because I don't understand iptables, or really want to understand it.

here, too, I'm using shorewall, because with the semantics in the config files, I can easily express what I want. It makes it easy to create very complex setups without knowing anything of iptables (although it helps to know about it). Moreover, the superb help of Tom Eastep and others in the support mailing list makes shorewall the firewall of my choice. Hence, the first thing I disable on a fresh centos install: firewall and sh**

I often wonder if I am in a small minority of CentOS users, who are just running home servers of some kind.

welcome to the club ;)

Regards Michael

On 08/14/2014 01:16 AM, Timothy Murphy wrote:

Jonathan Billings wrote:

...

'FirewallD' doesn't replace 'iptables' except in the sense of activated system services, not the core firewall functionality. FirewallD just builds and modifies iptables rules.

I'm a bit surprised no-one has mentioned shorewall. I'm using it on two tiny home servers, one under CentOS-6 and the other CentOS-7. Basically, this is because I don't understand iptables, or really want to understand it. Is firewalld a reasonable alternative in CentOS-6?

I often wonder if I am in a small minority of CentOS users, who are just running home servers of some kind. Most of the posters to this mailing list seem to be in charge of systems with hundreds if not thousands of users.

I run 6 servers currently (4 running CentOS-5 and 2 running CentOS-6) plus a laptop and a workstation running CentOS-6. Still to take the plunge into CentOS-7. My operating space is small business situations wanting low touch, high up time and reliability. Also a high aversion to being sold expensive software that in no way out-performs FOSS for all the basic tasks a small business needs to survive. Thus you are not alone and probably not that small a minority.

On Tue, Aug 12, 2014 at 09:26:17AM -0500, Neil Aggarwal wrote:

Jonathan:

...

Looking at the documentation closer, there does appear to be a way to add rules to the OUTPUT table, using the rich rules syntax.

Do you see a way to set the default policy to DROP?

Most likely, just adding the rich rule with the DROP in it will make the OUTPUT rule drop by default. I haven't tested it.

On Tue, 2014-08-12 at 09:59 -0500, Valeri Galtsev wrote:

Long ago I learned a rule (what users will expect from a good sysadmin): do not make any changes unless they are absolutely necessary.

The English (non-American) version is

"If it ain't broke, don't fix it."

So, to use in C7's firewalld (some of, because it is doubtful all exists) the functionality of IP Tables, one must first convert one's adequately expressed IP Tables wishes into a pseudo language which then changes the longer and more convoluted firewalld 'instruction' back into normal IP Tables syntax ?

Some may innocently believe this is wonderful for Red Hat's eventual Lindoze Linux but how is this making life easier for computer-knowledgeable people ? Is it genuinely sensible ?

Great, thanks!

It looks like I will survive even if they drop "iptables-service" in some future to come. Just for my understanding which of the following is incorrect:

1. firewalld is a front end to the iptables kernel module (pretty much as "iptables-service" is) 2. therefore the rules syntax is pretty much the same (well, is pretty close), only in config file(s) all is wrapped into xml (to please GUI front end used by GUI people). 3. in the past we had both kernel module and front end written by the same team of programmers (iptables), from now on we are using front end by one team of programmers for kernel module written by another team.

Thanks for all your help in understanding where do we stand now!

Valeri

On Tue, August 12, 2014 10:58 am, Jonathan Billings wrote:

On Tue, Aug 12, 2014 at 09:59:17AM -0500, Valeri Galtsev wrote:

...

Wonderful!

Can you do with firewalld an equivalent of the following done with iptables:

:SSHSCAN - [0:0] -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN -A SSHSCAN -m recent --set --name SSH -A SSHSCAN -m recent --update --seconds 300 --hitcount 10 --name SSH -j DROP -A INPUT -p tcp --dport 22 -j ACCEPT

Yes, I believe that's possible with the 'firewall-cmd --direct --addchain ...' and 'firewall-cmd --direct --add-rule ...' syntax:

# firewall-cmd --permanent --direct --add-chain ipv4 filter SSHSCAN success # firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow -p tcp --dport 22 -m state --state NEW -j SSHSCAN success # firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow 0 -p tcp --dport 22 -m state --state NEW -j SSHSCAN success # firewall-cmd --permanent --direct --add-rule ipv4 filter SSHSCAN 0 -m recent --set --name SSH success # firewall-cmd --permanent --direct --add-rule ipv4 filter SSHSCAN 1 -m recent --update --seconds 300 --hitcount 10 --name SSH -j DROP success # firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow 1 -p tcp --dport 22 -j ACCEPT success

This has the handy side-effect of being able to just drop this in /etc/firewalld/direct.xml:

# cat /etc/firewalld/direct.xml

<?xml version="1.0" encoding="utf-8"?>

<direct> <chain table="filter" ipv="ipv4" chain="SSHSCAN"/> <rule priority="0" table="filter" ipv="ipv4" chain="IN_public_allow">-p tcp --dport 22 -m state --state NEW -j SSHSCAN</rule> <rule priority="1" table="filter" ipv="ipv4" chain="IN_public_allow">-p tcp --dport 22 -j ACCEPT</rule> <rule priority="0" table="filter" ipv="ipv4" chain="SSHSCAN">-m recent --set --name SSH</rule> <rule priority="1" table="filter" ipv="ipv4" chain="SSHSCAN">-m recent --update --seconds 300 --hitcount 10 --name SSH -j DROP</rule> </direct>

You could also make sure that it's added to other zones other than 'public' (by using something other than IN_public_allow).

This is a *great* example of why firewalld wins over the old monolithic /etc/sysconfig/iptables. It's just a file I can manage with my CM tools. Changes to other firewall rules (such as allowing in port 80 for web servers) doesn't rewrite editing this file.

-- Jonathan Billings billings@negate.org _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++