New to firewalld, Questions about getting started.

Fryer, David David.Fryer at stratus.com
Thu Jun 4 12:15:06 UTC 2015


SSH is running on the standard port of 22, and selinux is enforcing. I don't think selinux is the problem, as adding "UseDNS no" to the end of sshd_config seems to bypass the issue entirely.
The output of ssh -vv is here: http://pastebin.com/tHMde40L

--David Fryer

P.S. Is there a standard/accepted way of sharing logs with this mailing list?
________________________________________
From: firewalld-users-bounces at lists.fedorahosted.org [firewalld-users-bounces at lists.fedorahosted.org] on behalf of Jim Campbell [jcampbell at gnome.org]
Sent: Wednesday, June 03, 2015 4:06 PM
To: firewalld-users at lists.fedorahosted.org
Subject: Re: New to firewalld, Questions about getting started.

Hello,

On Wed, Jun 3, 2015, at 10:41 AM, Fryer, David wrote:
> Hello,
> I am new to using firewalld. I have been through the documentation at
> https://fedoraproject.org/wiki/FirewallD, but am having some trouble with
> configuration. It would seem that, regardless of zone or services
> enabled, I cannot ssh into the machine that has firewalld running without
> adding the client's subnet to the trusted zone. In addition, adding
> "UseDNS no" to the end of /etc/ssh/sshd_config seems to ignore firewall
> configuration.
>
> I have been using firewall-cmd in order to set firewall options, if it
> makes a difference.
>
> It seems that there is no HOWTO for getting started with firewalld, and
> there doesn't seem to be any one resource that's helpful for
> troubleshooting problems such as this.
>
> Thank You,
> David Fryer
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users


Are you running SSH on the standard port of 22? Are you using SELinux in
Enforcing mode? If you are running SSH on a non-standard port, and have
SELinux enabled, you would also need to do something like:

  /usr/sbin/semanage port -a -t ssh_port_t -p tcp 1234

Where 1234 is the new port that you are using.  This would set things up
so that SELinux would be managing that port for SSH connections.

If that's not the issue, kindly post the output of your ssh connection
attempt using the -v or -vv flags so that we can see where the
connection is getting stuck.  Thanks,

Jim
_______________________________________________
firewalld-users mailing list
firewalld-users at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/firewalld-users


More information about the firewalld-users mailing list