Kicksecure Firewall

Development
1

What is the Firewall comes with Kicksecure on CLI? ufw was not included anywhere in any metapackage.

2

None yet. None has been developed yet.

related:

3

I am OK with current state, I don’t think we need extra Firewall.

4

While Kicksecure comes with no open ports by default, a firewall would be useful to protect the user from unwanted, unexpected ports opened by third-party software.

How this could be structured:

  • kicksecure-shared-firewall
  • kicksecure-desktop-firewall [block all ports by default]
  • kicksecure-server-firewall [open port 22, which is SSH’s default port by default]
    • Maybe the server firewall should come last. If ever. Much later. Maybe not at all. Maybe server operators should take care of a firewall themselves.
5

No worries.
I can use firewalld or ufw myself.

6

Note on UFW by default in Kicksecure:
Still depends on iptables. This seems outdated. Waiting at least until it has been ported to nftables.

7

Sorry for late reply, isn’t ufw just a front-end of iptables?

8

Based on web search, seems newer ufw versions support also nftables.

10

Of course.

iptables is deprecated. iptables → nftables.

11

How could Kicksecure be configured to have a firewall enabled by default for Kicksecure desktop but at the same time do not enable the firewall by default for users installing using distribution morphing method?

Why not enable Kicksecure firewall by default for users installing using distribution morphing method? It’s a too intrusive change. Because if they are distribution morphing a server, they might lock themselves out from SSH and other services such as their webserver might become unreachable.

What’s the solution?

A Kicksecure systemd unit which comes disabled by default using systemd presets. It would be enabled by default for Kicksecure for desktop using calamares but users using distribution morphing would need to run sudo systemctl enable --now kicksecure-firewall (not yet implemented at time of writing).

12

Thank you. I don’t really want this feature to be enabled by default. I mainly use Kicksecure as server or virtualization host.