Services questions
Thomas Woerner
twoerner at redhat.com
Tue Sep 1 11:53:08 UTC 2015
Hello Robert,
On 08/27/2015 04:44 PM, Robert Moskowitz wrote:
>
>
> On 08/27/2015 10:28 AM, Robert Moskowitz wrote:
>> For the past year, I just kind of hacked along with small things with
>> firewalld. But now I am configuring a Samba AD and that means lots
>> of rules. See:
>>
>> https://wiki.samba.org/index.php/Samba_AD_DC_port_usage
>>
>> I am trying really hard to stay with firewalld services and only do
>> ports where I have to.
>>
>> So right away I see a few things:
>>
>> Why is the ldap service tcp only?
>>
>> # cat /usr/lib/firewalld/services/ldap.xml
>> <?xml version="1.0" encoding="utf-8"?>
>> <service>
>> <short>LDAP</short>
>> <description>Lightweight Directory Access Protocol (LDAP)
>> server</description>
>> <port protocol="tcp" port="389"/>
>> </service>
>>
>> Seems this should also include udp.
>>
please have a look at
http://www.openldap.org/doc/admin24/security.html#IP%20Firewall
It lists 389/tcp for ldap and 636/tcp for ldaps.
I think I read something that Microsoft is using 389/udp, though. Are
you using OpenLDAP?
It should be possible to enable 389/udp also in the service if this is
needed.
>> Whereas mDNS is the flip. It has udp, but should also include tcp.
>
> Further checking on mDNS shows Avahi only listening on udp, so that
> one is not so much a concern. Other than udp IS a defined protocol
> for mDNS.
>
>>
>> Both of these I CAN handle with add-port, but wonder if the service
>> rule is really set up wrong. One would expect these two services to
>> be open for both ucp and tcp. Not one or the other.
>>
>> Finally I am suppose to enable "Dynamic RPC ports" which is 1024 -
>> 5000 and I cannot find any guidance on setting that one up.
>>
>> Otherwise, an interesting service and one I am slooooowly learning.
>>
>> thanks
>>
Regards,
Thomas
More information about the firewalld-users
mailing list