Skip to Content.
Sympa Menu

sm-grimoire-bugs - [SM-Grimoire-Bugs] [Bug 10910] New: firewall/iptables init scripts should start before network

sm-grimoire-bugs AT lists.ibiblio.org

Subject: SourceMage Grimoire Bug List

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-grimoire-bugs AT lists.ibiblio.org
  • Subject: [SM-Grimoire-Bugs] [Bug 10910] New: firewall/iptables init scripts should start before network
  • Date: 10 Apr 2006 05:55:12 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=10910

Summary: firewall/iptables init scripts should start before
network
Product: Codex
Version: stable grimoire
Platform: Other
OS/Version: other
Status: NEW
Severity: major
Priority: P2
Component: net
AssignedTo: MatthewClark AT InLesserTerms.net
ReportedBy: jblosser-smgl AT firinn.org
CC: security AT sourcemage.org,sm-grimoire-
bugs AT lists.ibiblio.org


I've discussed this with a few people on IRC, but wanted to put it out for
more
opinions before I actually work on implementing something.

I'm building the first SMGL box I'll have that needs a serious iptables
firewall. I don't use shorewall or anything like that, I just write my own
scripts. Obviously I want this started at system startup, but I don't want it
at the end ala bootmisc, I want it running before network comes up. So I was
thinking about adding an init.d script to the iptables spell that would just
run
/etc/sysconfig/iptables if it existed and was executable. Simple.

Then I went looking to see how other firewall spells we ship do this
(shorewall,
firehol, etc.) and was suprirsed to see they all just have NEEDS=network and
are
set up like any other runlevel 3 script! This is a rather bad idea... it
means
that if simpleinit starts up eg sshd and apache before your firewall service,
you have a race condition where attackers can hit your services behind the
firewall before the firewall is up. The firewall should always start before
networking.

To fix this, I propose we add a new facility 'firewall', and set any
appropriate
init.d scripts to provide this facility. shorewall and firehol would have it,
as would the new iptables stub I'm planning to add. Any others people know of
off the top of their heads? We would then set the network init.d script to
depend on 'firewall', using the new WANTS syntax (WANTS="+firewall"). This
would cause network to first start the firewall if one existed and ignore it
otherwise.

The one theoretical caveat of this is that iptables installs by default to
/usr/sbin. However we cannot make it depend on network and remote_fs, that
defeats the point. There's basically 3 options for this:

1) stick to the idea that anything that could be in /usr has to come after
network, including the firewall (bad)
2) change the default install paths for iptables to be /sbin (also bad, people
that don't use a remote /usr don't need this and probably don't want it, and
we
shouldn't change defaults without a much better reason than this)
3) leave it to the local admin to know that if they use a remote /usr they
need
to make sure any things needed to get the network going should not be on /usr
(including the firewall utils)

I definitely prefer 3. Agree/disagree? Any other concerns about getting this
going? Some people have mentioned that the firewall may need to change before
and after the network goes up due to things like ppp options, but to me that
just means the people that need that should set up a default firewall for when
ppp is down and then modify it when it comes up. That's the right way to do
this, and our netconf tools allow you to set post-connect hooks.

Matthew, I'll leave you as the default assigned for this, but I'm glad to just
do the work myself unless you have a concern with that. Let me know...

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.



  • [SM-Grimoire-Bugs] [Bug 10910] New: firewall/iptables init scripts should start before network, bugzilla-daemon, 04/10/2006

Archive powered by MHonArc 2.6.24.

Top of Page