I'm following instructions to automate the installation of Ubuntu Server 12.04 using kickstart. It works well for automatically partitioning the drives, selecting languages etc. However, it doesn't configure the firewall. It is a known issue.

Running without a firewall isn't a good idea. How does one configure the UFW firewall during installation to prevent unauthorized access to the server?

The kickstart file I have looks as follows (with only the username changed)

#System language
lang en_US
#Language modules to install
langsupport en_US
#System keyboard
keyboard us
#System mouse
#System timezone
timezone America/Los_Angeles
#Root password
rootpw --disabled
#Initial user
user johnd --fullname "John Doe" --iscrypted --password <omitted>
#Reboot after installation
#Use text mode install
#Install OS instead of upgrade
#Use CDROM installation media
#System bootloader configuration
bootloader --location=mbr 
#Clear the Master Boot Record
zerombr yes
#Partition clearing information
clearpart --all --initlabel 
#Disk partitioning information
part / --fstype ext4 --size 1 --grow 
part swap --recommended 
#System authorization infomation
auth  --useshadow  --enablemd5 
#Network information
network --bootproto=dhcp --device=eth0
#Firewall configuration
firewall --enabled --trust=eth0 --ssh 
#Do not configure the X Window System


I added the following the file above:

mkdir /usr/sample
ufw enable
ufw allow 22

After the installation, the directory /usr/sample exists, but the firewall is still disabled and access to port 22 isn't allowed.


You may use the %post (post-installation) part of the kickstart file to run the firewall rules, or even create a basic firewall script.

I found, on this site an usage example of post-installation configuration. And here you have another explanation of how to achieve what you want.

EDIT: %post suggestion:

mkdir /usr/sample
sed -i 's/^\(ENABLE=\s*\).*$/\1yes/' /etc/ufw/ufw.conf
sed -i 's/^COMMIT/-A ufw-before-input -p tcp --dport 22 -j ACCEPT\n\nCOMMIT/' /etc/ufw/before.rules
ufw status verbose > /usr/sample/ufw_out.log

Try and see if this will work. Maybe a little to over, but if this works, may be a nice workaround.

  • Tried it. Commands are executed, but calling UFW has no effect. – bloudraak Jan 13 '13 at 6:55
  • Can you post your file somewhere so I can see the entire picture? The known issue is that you can't configure firewall within the install... But the post-installation script you already have your system "ready". Try activating UFW, or even passing some rules to the configuration file, through commands on %post. – fboaventura Jan 13 '13 at 15:28
  • I updated my question to include the %post section. – bloudraak Jan 13 '13 at 20:04
  • I did the same with my answer, reflecting the suggestion of changes to your %post. – fboaventura Jan 13 '13 at 21:51
  • Will give it a try. The first sed statement seems invalid. The second works. Since the ufw command line actually modifies /lib/ufw/user6.rules and /lib/ufw/user.rules I'm going to replace those files and use sed to enable ufw.conf. – bloudraak Jan 14 '13 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.