<html><head></head><body>Anyone that can attack a Linux box by futzing with firewalld is already a guru and had root before you installed that OS. :-)<br><br><div class="gmail_quote">On January 27, 2019 1:45:41 PM EST, Alex Carver via Ale <ale@ale.org> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On 2019-01-27 09:47, Solomon Peachy wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">On Sun, Jan 27, 2019 at 09:18:28AM -0800, Alex Carver via Ale wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Perhaps but it seems like overkill to have a Python script (at the<br>moment I'm overlooking the imposed need to run an interpreter on your<br>firewall) managing iptables when, according to the documentation, any<br>rule that isn't a very simple one has to use what firewalld calls "rich<br>rules" which look exactly like a more verbose version of an iptables<br>command. It seems if you're going to have to issue a command that looks<br>just like an iptables command then why not cut the middleman and run<br>iptables? It already shows in the flow chart that it's just a wrapper<br>to iptables anyway (no direct access to the kernel).<br></blockquote><br>The purpose of firewalld is to abstract away the specific network <br>interfaces, operational modes, and firewall implementation from <br>applications (&| services) that only care about firewalling enough to <br>say "allow in the packets I care about" or "set my laptop up to be a <br>hotspot using my tethered cell phone"<br><br>For "workstation" or "server" systems, it's quite useful. It's also <br>good enough for a typical home gateway user, who only cares about <br>automatically NATting the system's internet connection. Beyond that, ie <br>for "router" systems, it's not so terribly useful.<br></blockquote><br>The documentation does appear to show that it really is intended to<br>control only basic inbound connections but I would argue that missing<br>outbound configurations doesn't make it overly useful for workstations<br>or servers which need outbound rules.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><br>(firewalld is inadequate to replace what I'm using for my home <br> gateway, but couple of years back it gained sufficient utility to <br> automagically power my camper trailer's hotspot, including <br> properly interacting with the VPN back to home...)<br></blockquote><br>It certainly wouldn't work for my router. What is it that it does for<br>you in your trailer configuration that wasn't possible before it existed?<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><br>It's different from UPnP in that there's deliberately no *remote* <br>interface that allows arbitrary ports opened in the firewall. All <br>command and configuration is localhost (via dbus) only.<br></blockquote><br>Fair enough, as long as only local the that does help some but it does<br>still add an attack surface even if root isn't compromised.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><br>(If the local system is sufficiently compromised to allow twiddlling of <br> firewalld, then it's sufficiently compromised to twiddle iptables/etc <br> directly..)<br></blockquote><br>That's half true. If the local system has a user account (but not root)<br>compromised then they don't have access to iptables since it requires<br>root. A dbus interface can have a compromise or access vector<br>independent of root because the user account could have been granted<br>access to dbus (whether accidentally or for some other purpose). I see<br>plenty of configuration examples just searching for dbus non-root to see<br>that it's possible to do. It just makes for an extra attack surface<br>which makes me nervous (nevermind that it's an entire python script so<br>you're depending on ptyhon to be safe).<hr>Ale mailing list<br>Ale@ale.org<br><a href="https://mail.ale.org/mailman/listinfo/ale">https://mail.ale.org/mailman/listinfo/ale</a><br>See JOBS, ANNOUNCE and SCHOOLS lists at<br><a href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a><br></pre></blockquote></div><br>-- <br>Sent from my Android device with K-9 Mail. All tyopes are thumb related and reflect authenticity.</body></html>