|
|
| (15 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| '''firewalld''' is a [[Firewall (computing)|firewall]] management tool for Linux
| |
| == Beschreibung ==
| |
|
| |
| === firewalld ===
| |
| It provides firewall features by acting as a front-end for the Linux kernel's [[netfilter]] framework via the [[nftables]] userspace utility (before v0.6.0 [[iptables]] backend), acting as an alternative to the nft command line program. The name ''firewalld'' adheres to the [[Unix]] convention of naming system [[daemon (computing)|daemons]] by appending the letter "d".
| |
|
| |
| firewalld is written in [[Python (programming language)|Python]]. It was intended to be ported to [[C++]], but the porting project was abandoned in January 2015.
| |
|
| |
| ==Features==
| |
| firewalld supports both [[IPv4]] and [[IPv6]] networks and can administer separate ''firewall zones'' with varying degrees of trust as defined in ''zone profiles''. Administrators can configure [[Network Manager]] to automatically switch zone profiles based on known [[Wi-Fi]] (wireless) and [[Ethernet]] (wired) networks, but firewalld cannot do this on its own.
| |
|
| |
| Services and applications can use the [[D-Bus]] interface to query and configure the firewall. firewalld supports timed rules, meaning the number of connections (or "hits") to a service can be limited globally. There is no support for hit-counting and subsequent connection rejection per source IP; a common technique deployed to limit the impact of [[Brute-force search | brute-force]] [[security hacker | hacking]] and [[distributed denial-of-service]] attacks.
| |
|
| |
| firewalld's command syntax is similar to but more verbose than other [[iptables]] front-ends like [[Ubuntu (operating system)|Ubuntu]]'s [[Uncomplicated Firewall]] (ufw). The command-line interface allows managing firewall rulesets for protocol, ports, source and destination; or predefined services by name.
| |
|
| |
| Services are defined as [[XML]] files containing port- and protocol-mappings, and optionally extra information like specifying [[subnetwork|subnets]] and listing required Kernel helper modules.
| |
|
| |
| The syntax resembles that of [[systemd]]'s service files. A simple service file for a web server listening on [[Transmission Control Protocol|TCP]] port 443 might look like this:
| |
|
| |
| <nowiki><source lang="xml"></nowiki>
| |
| <?xml version="1.0" encoding="utf-8"?>
| |
| <service>
| |
| <short>Web Server</short>
| |
| <description>Public web host over HTTPS.</description>
| |
| <port port="443" protocol="tcp" />
| |
| </service>
| |
| <nowiki></source></nowiki>
| |
|
| |
| ==Limitations==
| |
| Firewalld currently does not support outbound rules to the same capacity of inbound rules. Limitations include things such on ipsets, service names, and default outbound block by default rules required by standards such as NIST 800-171 and 800-53. Default block all needs to be done at the "raw" IPTables level via the --direct flag, and with the order of operations FirewallD uses to prioritize Rrules, rich rules, direct rules, it may be easier to enter all rules for outbound via --direct or use iptables (netfilter-persist)
| |
|
| |
| ==Graphical front-ends (GUIs)==
| |
| '''firewall-config'''
| |
|
| |
| is a graphical front-end that is optionally included with firewalld, with support for most of its features.
| |
|
| |
| '''firewall-applet'''
| |
|
| |
| is a small status indicator utility that is optionally included with firewalld. It can provide firewall event log notifications as well as a quick way to open firewall-config. firewall-applet was ported from the [[GTK+]] to the [[Qt (software)|Qt]] framework in the summer of 2015 following the [[GNOME Desktop]]’s deprecation of [[system tray]] icons.
| |
|
| |
| ==Adoption==
| |
| firewalld ships by default on the following Linux distributions
| |
| * [[CentOS]] 7 and newer
| |
| * [[Fedora (operating system)|Fedora]] 18 and newer
| |
| * [[Red Hat Enterprise Linux]] 7 and newer
| |
| * [[OpenSUSE]] Leap 15 and newer<ref name="SUSE">https://en.opensuse.org/Firewalld</ref>
| |
| * [[SUSE Linux Enterprise]] 15 and newer<ref name="SUSE" />
| |
|
| |
| firewalld is enabled by default in all of these distributions. firewalld is also available as one of many firewall options in the package repository of many other popular distributions such as [[Debian]] or Ubuntu.
| |
| == Installation ==
| |
| == Anwendungen ==
| |
| == Syntax ==
| |
| === Optionen ===
| |
| === Parameter ===
| |
| === Umgebungsvariablen ===
| |
| === Exit-Status ===
| |
| == Konfiguration ==
| |
| === Dateien ===
| |
| == Sicherheit ==
| |
| == Dokumentation ==
| |
| === RFC ===
| |
| === Man-Pages ===
| |
| === Info-Pages ===
| |
| == Siehe auch ==
| |
| == Links ==
| |
| === Projekt-Homepage ===
| |
| === Weblinks ===
| |
| === Einzelnachweise ===
| |
| <references />
| |
| == Testfragen ==
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 1''
| |
| <div class="mw-collapsible-content">'''Antwort1'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 2''
| |
| <div class="mw-collapsible-content">'''Antwort2'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 3''
| |
| <div class="mw-collapsible-content">'''Antwort3'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 4''
| |
| <div class="mw-collapsible-content">'''Antwort4'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 5''
| |
| <div class="mw-collapsible-content">'''Antwort5'''</div>
| |
| </div>
| |
|
| |
| [[Kategorie:Entwurf]]
| |
| [[Kategorie:Firewall]] | | [[Kategorie:Firewall]] |
| [[Kategorie:RedHat]] | | [[Kategorie:RedHat]] |
|
| |
|
| |
| = TMP =
| |
|
| |
|
| |
|
| |
|
| |
|
| |
| ==Weblinks==
| |
| * https://en.wikipedia.org/wiki/Firewalld
| |
| * https://www.techgrube.de/tutorials/centos-firewall-konfigurieren-mit-firewalld
| |
| * https://firewalld.org/documentation/man-pages/firewall-cmd.html
| |
| * https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7
| |
| * https://computingforgeeks.com/how-to-install-and-configure-firewalld-on-debian/
| |
| * https://www.linuxnix.com/installing-configuring-firewalld-linux/
| |
| * https://www.redhat.com/sysadmin/secure-linux-network-firewall-cmd
| |