57_Wolve/automations
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(harden): backend-neutral firewall wording; skip iptables sshguard jump on firewalld

Browse Source 
The harden scripts logged 'deny-by-default INPUT; carries the sshguard jump'
even on Alma, where the firewall is firewalld (no INPUT chain, no jump). Make the
message backend-neutral, and when ENABLE_FIREWALL=0 on rhel skip the iptables
boot-hook entirely -- sshguard's firewalld backend manages its own ipset blocks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
57_Wolve
2026-06-14 17:46:34 -05:00
co-authored by Claude Opus 4.8
parent fe25f35305
commit cff1e1d666
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/harden-jumphost.sh
+7 -2
View File
@@ -307,11 +307,16 @@ EOF
# hook that just (re)inserts the jump at every boot.
: "${ENABLE_FIREWALL:=1}"
if [[ "$ENABLE_FIREWALL" == "1" && -f "$SCRIPT_DIR/harden-firewall.sh" ]]; then
log "Installing host firewall (deny-by-default INPUT; carries the sshguard jump)..."
log "Installing host firewall (deny-by-default; iptables or firewalld per OS)..."
SSH_PORT="$SSH_PORT" OPEN_PORTS="${OPEN_PORTS:-}" \
FW_SSH_SOURCE="${FW_SSH_SOURCE:-}" FW_ALLOW_PING="${FW_ALLOW_PING:-1}" \
FORCE=1 bash "$SCRIPT_DIR/harden-firewall.sh" apply \
|| warn "harden-firewall.sh failed; INPUT left unfiltered. Re-run it manually."
|| warn "harden-firewall.sh failed; host firewall not applied. Re-run it manually."
elif [[ "$OS_FAMILY" == rhel ]]; then
# On Alma/RHEL sshguard uses its firewalld backend (sshg-fw-firewalld) and
# manages its own firewalld ipset blocks -- there is no iptables INPUT->sshguard
# jump to add, so skip the boot hook.
warn "Host firewall disabled; sshguard manages firewalld directly (no iptables jump)."
else
HOOK=$(mktemp)
cat > "$HOOK" <<'EOF'
scripts/harden-ssh.sh
+7 -2
View File
@@ -286,11 +286,16 @@ EOF
# hook that just (re)inserts the jump at every boot.
: "${ENABLE_FIREWALL:=1}"
if [[ "$ENABLE_FIREWALL" == "1" && -f "$SCRIPT_DIR/harden-firewall.sh" ]]; then
log "Installing host firewall (deny-by-default INPUT; carries the sshguard jump)..."
log "Installing host firewall (deny-by-default; iptables or firewalld per OS)..."
SSH_PORT="$SSH_PORT" OPEN_PORTS="${OPEN_PORTS:-}" \
FW_SSH_SOURCE="${FW_SSH_SOURCE:-}" FW_ALLOW_PING="${FW_ALLOW_PING:-1}" \
FORCE=1 bash "$SCRIPT_DIR/harden-firewall.sh" apply \
|| warn "harden-firewall.sh failed; INPUT left unfiltered. Re-run it manually."
|| warn "harden-firewall.sh failed; host firewall not applied. Re-run it manually."
elif [[ "$OS_FAMILY" == rhel ]]; then
# On Alma/RHEL sshguard uses its firewalld backend (sshg-fw-firewalld) and
# manages its own firewalld ipset blocks -- there is no iptables INPUT->sshguard
# jump to add, so skip the boot hook.
warn "Host firewall disabled; sshguard manages firewalld directly (no iptables jump)."
else
HOOK=$(mktemp)
cat > "$HOOK" <<'EOF'