On Tue, Oct 13, 2020 at 10:49:52AM +0000, Jason Long wrote:
Thank you.If IÂ remove "SSH" from services section then no security problem? The rich rule protecting my service?
The rich rule is _allowing_ the service. "protecting" is the wrong word.
On Monday, October 12, 2020, 04:51:55 PM GMT+3:30, Eric Garver <egarver@redhat.com> wrote:On Sat, Oct 10, 2020 at 09:43:01AM +0000, Jason Long wrote:
Thank you. Then, I must remove "SSH" from services section
Yes.
and open port 22?
No. That's already done with the rich rule.
On Monday, October 5, 2020, 04:37:52 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active) ÃÂ target: default ÃÂ icmp-block-inversion: no ÃÂ interfaces: ens192 ÃÂ sources: ÃÂ services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
ÃÂ ports: 990/tcp 40000-50000/tcp ÃÂ protocols: ÃÂ masquerade: no ÃÂ forward-ports: ÃÂ source-ports: ÃÂ icmp-blocks: ÃÂ rich rules: ÃÂ ÃÂ ÃÂ rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...