Appreciated hints about expected exact firewall-offline-cmd --direct --add-rule / --query-rule syntax (mainly about the priority field) or corresponding richlanguage syntax
Jan Lieskovsky
jlieskov at redhat.com
Wed Aug 27 10:39:51 UTC 2014
Hello folks,
I participate on developing SCAP content:
[1] http://scap.nist.gov/
within the SCAP Security Guide project:
[2] https://fedorahosted.org/scap-security-guide/
Within that [2] project we develop security compliance guidance for Red Hat
products (content for RHEL-6, RHEL-7, Fedora already exist, content for products
like OpenStack, RHEVM3, JBossEAP5 needs care yet).
Within the process of identification, which parts of existing RHEL-6 content
would require modification when trying to port it to RHEL-7 we identified firewalld
as one of the components, that might require our attention.
FWIW regarding firewall configuration the system administrators situation slightly
changed when considering RHEL-6 and RHEL-7. For the very least, in RHEL-6 there was
system-config-firewall tool, which in RHEL-7 the firewall can be managed in two ways
(when not counting direct iptables command usage):
* via system-config-firewall or
* via firewalld.
From the very introductory article:
[3] http://www.oracle-base.com/articles/linux/linux-firewall-firewalld.php
each of these (system-config-firewall & firewalld) constitute different approaches
to the system's firewall administration / management. Starting from differing
config files (/etc/sysconfig/iptables, /etc/sysconfig/ip6tables for s-c-f vs
the XML format based configuration files in /usr/lib/firewalld/services -- the
services XML templates, and actually honoured configuration present in
/etc/firewalld/services), through the concept of zones, firewalld introduced a
different view at system's firewall administration / management.
Consider the use case:
-----------------------
What we have now are iptables rules defined in the form acceptable / generated
by s-c-f (for RHEL-6). But when checking RHEL-7 system to be security compliant
wrt to firewall settings we will also need to check the newly added config location
(/etc/firewalld/services) if it contains the corresponding rules expressed in the
form as accepted / expected by firewalld.
Have searched the firewalld manual pages deeper and noticed firewalld package
provides firewall-offline-cmd for cases like this (when the firewalld service isn't
running) to migrate older s-c-f rules to newer firewalld syntax.
Actually moved yet further, and tried firewall-offline-cmd --direct --add-rule
case.
Suppose the old rule (from /etc/sysconfig/iptables for IPv4) has the form of
(for simplicity):
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
then the corresponding firewall-offline-cmd command syntax that came out from
reading of the manual pages for me is as follows:
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
Execution of this command succeeded & appropriate /etc/firewalld/direct.xml entry
was created.
Wanted to ask regarding the priority parameter ("0" in the above example) -- is it
a way how to specify "order / place" into which the rule would be added into the
XML file? IOW using 0 again second time would mean the second rule would be inserted
before the already existing rule (e.g. the behaviour of -I iptables option) or when
using priority 1 it would be appended instead at the end of the filter table & INPUT
chain of it (e.g. the behaviour would correspond to -A iptables option)?
Another question being -- also noticed firewalld provides concept of "richlanguage"
which allows (at least from what I got) the administrator to define the rules in
the iptables-like syntax. Since it's not mentioned in the manual page, does richlanguage
support concept of "match extensions", e.g. for example:
-m iprange | -m limit | -m state | -m time | -m account ..
as known / supported by iptables? If yes, what would be the syntax to formulate these
in the richlanguage syntax? To mention some examples, suppose the following two
rules:
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 10 -j ACCEPT
iptables -A INPUT -p tcp --dport 50:55 -m iprange --dst-range 192.168.0.1-192.168.0.10 -j ACCEPT
Is there a way how to express them via firewalld's richlanguage constructs or would
the usage of firewall-offline-cmd --direct --add-rule be necessary?
Is it possible to commonly express what kind of former iptables rules are possible
to express via richlanguage & what kind of rules require use of firewall-offline-cmd
tool?
Thank you in advance for your time & reply.
Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
More information about the firewalld-users
mailing list