[CentOS] CentOS 7 - Firewall always allows outgoing packets?

Mon Aug 11 15:23:09 UTC 2014
Valeri Galtsev <galtsev at kicp.uchicago.edu>

On Mon, August 11, 2014 8:28 am, Johnny Hughes wrote:
> On 08/09/2014 09:45 AM, Valeri Galtsev wrote:
>> On Sat, August 9, 2014 9:15 am, Neil Aggarwal wrote:
>>> Tom:
>>>> I thought we were supposed to be moving forward
>>> That is my thought exactly.  This is a step backwards.
>>> I guess I will disable firewalld and go back to iptables.
>> Systemd, firewalld... Linux from what formerly was "UNIX-like" becomes "MS
>> Windows-like". This is what you will hear from everybody fleeing Linux (I
>> for one started gradually moving servers to FreeBSD a while back).
>
> You and 4 other guys are moving things from Linux to FreeBSD.

You only spotted 4 _last_ guys running away to UNIX. The rest fled quite a
while ago. Some 7 years ago the guy looking for new system to move his
servers from Linux to called Linux "Lindoze". Don't explode on me, I held
myself for several posts and didn't repeat that. But he was so much
cleverer than I am: already then he realized Linux is becoming "MS
Windows-like" system.

Again, I have to repeat: I was happy with Linux for over decade and a
half. However, the changes are such that at least my server are moving
(some of them have moved already) away from Linux.

>
> The rest of the world is moving things from UNIX and Windows to Linux.

It takes quite a self confidence to say "the whole world is doing..." and
then describe one's own opinion. Well, part of the World is doing good
thing: the ones who move away from Windows. Moving from UNIX... I better
hold my opinion about this.

>
> CentOS-7 rebuild RHEL sources and most all of the "important" Enterprise
Linux things are moving to RHEL.
>
> RHEL runs the stock exchanges, the banks, etc.

Which of the banks and stock exchanges are you working for? Never mind.
You may be quite right as some on them which for long time used M$, are
likely moving away, and Linux is definitely much better choice that M$,
and easier step than from M$ to, say, FreeBSD...

>
> Free BSD is fine and people can use it if they like ... but if you want
real Enterprise grade software, it needs to be RHEL based, that is just
the way it is.

This may be about the definition of what one calls "Enterprise" system.

1. The system that runs securely for multiple Months without need for
reboot, without kernel Oopses... Even if you need some effort to install
and configure what you need, and have be somewhat careful in choice of
hardware, but then you get ultimately reliable box. I may be off canonical
definition, but this would be my choice of servers I run for the
Departments I support.

2. The system that is nice replacement of M$ system, easy to install,
which runs millions of names of great software - without need to put much
effort in building or God forbid porting to your system. And even though I
do not call this "Enterprise" and do not prefer this for servers, I do
prefer this system for workstations for my users. That is why I'm still on
this mail list. Still maintaining public CentOS Linux and Ubuntu mirrors
(and will add Debian mirror as another sysadmin who was maintaining Debian
mirror left our University). So, this is why you still can hear me as one
of the 4 fleeing [servers] from Linux.

>
> Keep in mind that EL 7.0 is a 'dot zero release' and some of the
features need work.  It works for the majority of use cases, but some
features will need to be enhanced, and Red Hat will enhance it.  When
they do, we will build the source code and it will be in CentOS.

And it looks like finally I start realizing that if I take what you said
almost literally, you may be right. What I mean is: I'm sysadmin working
for a couple of hundreds of scientists. I chose UNIX for servers. One
person. My users - scientists - would chose Linux for their goals (they
mostly choose MacOS actually for their laptops...). 200 people. (They fled
M$ over 10 years ago...) In this statistics 200:1 you are right. Right?

In any case the "Enterprise" definition may be different depending on what
you do: run the server for 200+ users or the server for 3 users (yourself,
you spouse and a good friend next door). Sorry, I used hyperbole here, do
not take it literally ;-)

Valeri

>
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>


++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++