Description of problem: Install from classical iso dated 29/11 and proceed to Summary screens. * The services section does not show the shorewall(6) services * The security part shows that the firewall is disabled by default. * Even after changing it to "enabled" it keeps showing "disabled" on return to the summary. AND * After reboot the shorewall is running but: systemctl status shorewall6.service shows it failed to start, "restart" does not work either On the other hand this is not surprising because /etc/shorewall6/zones is missing a line like quote net ipv6 unquote which I do have in my running Cauldron (Note: other files not inspected). [ I do not know if this is supposed to be one bug or more, if more lemme know and tell what else is needed ] Reproducible: Steps to Reproduce:
Whiteboard: (none) => 6dev1
Hi, sorry for having overlooked this bug report. Do you still reproduce this bug with the latest ISO? If so, please attach the /root/drakx/report.bug.xz file produced by the installer after the installation is complete.
Keywords: (none) => NEEDINFO
I will look for it with the next pre-release iso and report here
Yes, iso of 07/03 there is no shorewall(6) in the Summary -> Services. I will attach report.bug.xz later today.
Keywords: NEEDINFO => 6dev1Source RPM: classical iso dated 29/11 => classical iso dated 07/03Whiteboard: 6dev1 => (none)
When accessing summary it proves also that the firewall is disabled by default, which is undesirable as it is a security risk. When going into Summary --> Firewall it can be configured under 'Advanced" so I did. I take it this concerns the shorewalls, although that name is never shown. I enabled them for eth0 and wlan0. But after reboot shorewall runs and systemctl status shows shorewall6.service failed! Moreover, when leaving the summary --> firewall section and going back to summary the summary still shows firewall as "disabled" ! I am attaching report.bug.xz
Created attachment 7536 [details] report.bug.xz
Looking into the files "zones" under /etc/shorewall and /etc/shorewall6 explains the difference: shorewall (4) ends with the lines net ipv4 fw firewall and is working okay Whereas the shorewall6 file ends with the line *only* fw firewall i.e. the line net ipv6 is missing and so this is why shorewall6 fails to run.
Another part of the bug: /etc/shorewall6/policy is virginal: The last lines are missing which should read for example fw net ACCEPT net all DROP info all all REJECT info same as in /etc/shorewall/policy
Valid for 6sta1 classical iso of 20th May 2016. Effectively this makes my sales pitch null and void that Linux is secure: with no firewall it is not. With firewall enabled there is no accessible internet. I propose this needs to be release blocker by the time we get to final release of M6.
Keywords: 6dev1 => 6sta1Hardware: i586 => All
Also valid for 2 May 2016 live isos in live mode.
Summary: Installer Summary --> services does not show shorewalls, security shows firewall disabled by default => Installer Summary --> services does not show shorewalls, security shows firewall disabled by default (also live mode of live isos)Source RPM: classical iso dated 07/03 => drakx-installer-stage2
Depends on: (none) => 18509
valid for iso dated 06 June 2016
Status: NEW => ASSIGNEDCC: (none) => thierry.vignaudAssignee: bugsquad => thierry.vignaudSource RPM: drakx-installer-stage2 => drakx-installer-stage2, drakx-net
commit ee45d93276cf795a53fcb0351a78fe7e6b1a4b5c Author: Thierry Vignaud <thierry.vignaud@...> Date: Wed Jun 22 10:30:56 2016 +0200 fix getting systemd services status at install Some services such as shorewall are not "wantedby". However, as systemd is not running during installation, we failed to detect if whether they're enabled or not as the legacy fallback doesn't handle such services Let's try hard to query status of services that are not "wanted" but we're checking for. Thus fixing updating firewall status after configuration (mga#17288) --- Commit Link: http://gitweb.mageia.org/software/drakx/commit/?id=ee45d93276cf795a53fcb0351a78fe7e6b1a4b5c
Closing
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED