3

I'm following instructions to automate the installation of Ubuntu Server 12.04 using kickstart. It works well for automatically partitioning the drives, selecting languages etc. However, it doesn't configure the firewall. It is a known issue.

Running without a firewall isn't a good idea. How does one configure the UFW firewall during installation to prevent unauthorized access to the server?

The kickstart file I have looks as follows (with only the username changed)

#System language
lang en_US
#Language modules to install
langsupport en_US
#System keyboard
keyboard us
#System mouse
mouse
#System timezone
timezone America/Los_Angeles
#Root password
rootpw --disabled
#Initial user
user johnd --fullname "John Doe" --iscrypted --password <omitted>
#Reboot after installation
reboot
#Use text mode install
text
#Install OS instead of upgrade
install
#Use CDROM installation media
cdrom
#System bootloader configuration
bootloader --location=mbr 
#Clear the Master Boot Record
zerombr yes
#Partition clearing information
clearpart --all --initlabel 
#Disk partitioning information
part / --fstype ext4 --size 1 --grow 
part swap --recommended 
#System authorization infomation
auth  --useshadow  --enablemd5 
#Network information
network --bootproto=dhcp --device=eth0
#Firewall configuration
firewall --enabled --trust=eth0 --ssh 
#Do not configure the X Window System
skipx

UPDATE

I added the following the file above:

%post
mkdir /usr/sample
ufw enable
ufw allow 22

After the installation, the directory /usr/sample exists, but the firewall is still disabled and access to port 22 isn't allowed.

Improve this question

1 Answer 1

Reset to default
3

You may use the %post (post-installation) part of the kickstart file to run the firewall rules, or even create a basic firewall script.

I found, on this site an usage example of post-installation configuration. And here you have another explanation of how to achieve what you want.

EDIT: %post suggestion:

%post
mkdir /usr/sample
sed -i 's/^\(ENABLE=\s*\).*$/\1yes/' /etc/ufw/ufw.conf
sed -i 's/^COMMIT/-A ufw-before-input -p tcp --dport 22 -j ACCEPT\n\nCOMMIT/' /etc/ufw/before.rules
ufw status verbose > /usr/sample/ufw_out.log

Try and see if this will work. Maybe a little to over, but if this works, may be a nice workaround.

Improve this answer
8
  • Tried it. Commands are executed, but calling UFW has no effect.
    – bloudraak
    Jan 13, 2013 at 6:55
  • Can you post your file somewhere so I can see the entire picture? The known issue is that you can't configure firewall within the install... But the post-installation script you already have your system "ready". Try activating UFW, or even passing some rules to the configuration file, through commands on %post.
    – fboaventura
    Jan 13, 2013 at 15:28
  • I updated my question to include the %post section.
    – bloudraak
    Jan 13, 2013 at 20:04
  • I did the same with my answer, reflecting the suggestion of changes to your %post.
    – fboaventura
    Jan 13, 2013 at 21:51
  • Will give it a try. The first sed statement seems invalid. The second works. Since the ufw command line actually modifies /lib/ufw/user6.rules and /lib/ufw/user.rules I'm going to replace those files and use sed to enable ufw.conf.
    – bloudraak
    Jan 14, 2013 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .