Now we're going to start taking a look at adding and removing services,
and configuring our firewall system. Now if we install http and enable
our web server, if we try then from our remote system to connect through
to our AlmaLinux system, we're not going to be able to because we're not
allowing inbound HTTP traffic. If we add the service, then we are going
to be allowed.
But remember, if we've just added our service and we haven't
specified any persistent configuration, it's only in our runtime configuration.
So if I go through then and do a list‑all and a list‑all permanent,
we're going to see there is a different, and then we can
flush our runtime configuration to the permanent
configuration once we know that it's working.
But this is only one side of our configuration, adding services that we need.
We also should be removing services that we don't need, as well
as looking at the error that we saw that was generated when we
looked at the status of our firewalld.
So come on,
let's move out to our command line and take a look at securing the firewall to
match our needs, so taking a look at our firewalld.conf, adding and removing
services. And here we are then, checking in for our next lesson in learning, and
we're going to remind ourselves to begin with the warning message that we had
from the status of our firewalld.
We can see that we've got AllowZoneDrifting is enabled.
Now this can allow, under certain circumstances, inbound traffic to
one zone moving across to inbound on another zone,
which is not desirable or secure.
So we need to disable this, and we do this through our etc and
firewalld directory, and the firewalld.conf.
When I go through and look at this,
it's reasonably well documented, and I just need to look for that message,
so, Allow Drifting. We can see here the AllowZoneDrifting, and it's
configured to be yes. We need to make sure that this is no longer
configured, so I can then move down, and we can change the yes on
AllowZoneDrifting to no. With this then configured,
I will restart my firewalld service so it rereads the configuration file.
There are few times that I do need to restart the service, but this is
one of them as I change the basic configuration rather than just rules.
Now as I go through and recheck my status,
we can see we are no longer seeing that warning, so we are good to go, we
know that we've got a nice secure platform to work with.
However, when I go through and start listing my runtime configuration,
we can see that we're allowing cockpit,
the web management interface which we're not currently running.
We're not running a dacpv6‑client, so I don't need that configuration.
We're only running an SSH service at the moment, so we
shouldn't allow traffic that is not required,
irrelevant of it being default or not.
So we can run our firewall‑cmd command with a ‑‑remove‑service, and we can
then choose our cockpit service and our dhcpv6 (version 6) ‑client. Once
these have been removed we can go back now and relist, and we can see then
that we've got SSH that is allowed.
So this is good,
everything is working the way that we want, but we might want to
add additional services, and just as we disallow services, we're
going to have to allow inbound services.
So let's just go through and do a very simple install of our web server.
We can allow this to run through. The web server is the httpd package when we
look at Red Hat‑based system, and is the httpd service rather than Apache 2
that we saw on our Debian‑based Ubuntu system.
We need to enable the service. By default on Ubuntu it would be enabled by
default, but we need to explicitly start and enable our service, and then
moving out to one of our client systems, I'm just using the Ubuntu system
here, my IP address for my AlmaLinux system is 192.168.33.11, and we can see
with a very basic curl test, we're unable to connect. And I'm hoping that
you accept that this is what we should be able to see, we haven't enabled
inbound http traffic yet, but we can do this with our firewall‑cmd command.
Remember, we could remove services, so we've got the add‑service
command, and we can then add in the http service.
So this is going to allow our inbound http traffic.
So if I go through and run a ‑‑list‑all, we can see then that we've got
services http and ssh, we're allowing those inbound traffic.
So returning then through to my Ubuntu system and running
the curl command, I'm now able to connect.
Don't worry about seeing the HTML information, remember
curl is not really a browser, but it's just allowing me to
connect to the web service.
Now, returning through to my AlmaLinux system, if I go through and
list all and try the permanent configuration,
we can see as we take a look at the output that we
haven't changed anything from the defaults.
So our runtime configuration has been made, but not our persistent or permanent.
So we can then go through, once we know then our runtime
configuration is working, we can then take our runtime
configuration and flush it through to disk to the XML files and
store it as our permanent configuration.
So now each time firewalld will start up, it's loading the XML files that we've persisted in our file system.