Bug 128120
Summary: | Firewall 'enabled' but all iptables chains default to ACCEPT | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Ben Smith <fedora> |
Component: | redhat-config-securitylevel | Assignee: | Brent Fox <bfox> |
Status: | CLOSED NOTABUG | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | rawhide | Keywords: | Security |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2004-07-31 03:05:50 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Ben Smith
2004-07-18 19:08:05 UTC
OK, it appears this is the same as all Fedora versions since FC1. It appears the default is a firewall that rejects anything under port 1024 and a few other things like X11, nfs and xfs. So perhaps it isn't really a concern, but it is unexpected. Maybe putting a description of the pitfalls of such a setup in the installer would be helpful. What would be the downside of a conntrack type firewall instead? Heh, well sorry, but I've been looking at about three different boxes, one of which was upgraded. I see now the default since FC1 *is* a conntrack-type firewall, but the /etc/sysconfig/iptables file is not overwritten during upgrades, which caused my confusion. I also see that any request not handled by the rules is REJECTed, so the default settings are never used. |