From cff1e1d66653ca16038229fe962051692c13e291 Mon Sep 17 00:00:00 2001
From: William Gill <william.gill@anomalous.dev>
Date: Sun, 14 Jun 2026 17:46:34 -0500
Subject: [PATCH] fix(harden): backend-neutral firewall wording; skip iptables
 sshguard jump on firewalld

The harden scripts logged 'deny-by-default INPUT; carries the sshguard jump'
even on Alma, where the firewall is firewalld (no INPUT chain, no jump). Make the
message backend-neutral, and when ENABLE_FIREWALL=0 on rhel skip the iptables
boot-hook entirely -- sshguard's firewalld backend manages its own ipset blocks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/harden-jumphost.sh | 9 +++++++--
 scripts/harden-ssh.sh      | 9 +++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/scripts/harden-jumphost.sh b/scripts/harden-jumphost.sh
index 9a75a9c..6fc32b4 100644
--- a/scripts/harden-jumphost.sh
+++ b/scripts/harden-jumphost.sh
@@ -307,11 +307,16 @@ EOF
 # hook that just (re)inserts the jump at every boot.
 : "${ENABLE_FIREWALL:=1}"
 if [[ "$ENABLE_FIREWALL" == "1" && -f "$SCRIPT_DIR/harden-firewall.sh" ]]; then
-    log "Installing host firewall (deny-by-default INPUT; carries the sshguard jump)..."
+    log "Installing host firewall (deny-by-default; iptables or firewalld per OS)..."
     SSH_PORT="$SSH_PORT" OPEN_PORTS="${OPEN_PORTS:-}" \
     FW_SSH_SOURCE="${FW_SSH_SOURCE:-}" FW_ALLOW_PING="${FW_ALLOW_PING:-1}" \
     FORCE=1 bash "$SCRIPT_DIR/harden-firewall.sh" apply \
-        || warn "harden-firewall.sh failed; INPUT left unfiltered. Re-run it manually."
+        || warn "harden-firewall.sh failed; host firewall not applied. Re-run it manually."
+elif [[ "$OS_FAMILY" == rhel ]]; then
+    # On Alma/RHEL sshguard uses its firewalld backend (sshg-fw-firewalld) and
+    # manages its own firewalld ipset blocks -- there is no iptables INPUT->sshguard
+    # jump to add, so skip the boot hook.
+    warn "Host firewall disabled; sshguard manages firewalld directly (no iptables jump)."
 else
     HOOK=$(mktemp)
     cat > "$HOOK" <<'EOF'
diff --git a/scripts/harden-ssh.sh b/scripts/harden-ssh.sh
index 20fe080..e563a00 100644
--- a/scripts/harden-ssh.sh
+++ b/scripts/harden-ssh.sh
@@ -286,11 +286,16 @@ EOF
 # hook that just (re)inserts the jump at every boot.
 : "${ENABLE_FIREWALL:=1}"
 if [[ "$ENABLE_FIREWALL" == "1" && -f "$SCRIPT_DIR/harden-firewall.sh" ]]; then
-    log "Installing host firewall (deny-by-default INPUT; carries the sshguard jump)..."
+    log "Installing host firewall (deny-by-default; iptables or firewalld per OS)..."
     SSH_PORT="$SSH_PORT" OPEN_PORTS="${OPEN_PORTS:-}" \
     FW_SSH_SOURCE="${FW_SSH_SOURCE:-}" FW_ALLOW_PING="${FW_ALLOW_PING:-1}" \
     FORCE=1 bash "$SCRIPT_DIR/harden-firewall.sh" apply \
-        || warn "harden-firewall.sh failed; INPUT left unfiltered. Re-run it manually."
+        || warn "harden-firewall.sh failed; host firewall not applied. Re-run it manually."
+elif [[ "$OS_FAMILY" == rhel ]]; then
+    # On Alma/RHEL sshguard uses its firewalld backend (sshg-fw-firewalld) and
+    # manages its own firewalld ipset blocks -- there is no iptables INPUT->sshguard
+    # jump to add, so skip the boot hook.
+    warn "Host firewall disabled; sshguard manages firewalld directly (no iptables jump)."
 else
     HOOK=$(mktemp)
     cat > "$HOOK" <<'EOF'