OracleLinux8.3のfirewalldでエラー「Invalid option: 'AllowZoneDrifting=yes'」を検知した時の対処手順メモ
OracleLinux8.3の再起動時にfirewalldでエラーメッセージ「Invalid option: 'AllowZoneDrifting=yes'」を検知しました。
今回はその対処手順を記載します。
検知したエラーメッセージ
以下のエラーメッセージを検知していました。
/var/log/messages
Dec 20 10:40:13 SV-IXION firewalld[927]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now. Dec 20 10:45:32 SV-IXION firewalld[927]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now. Dec 20 10:58:03 SV-IXION firewalld[960]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.
/var/log/firewalld
2020-12-20 10:40:13 WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now. 2020-12-20 10:45:32 WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now. 2020-12-20 10:58:03 WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.
「AllowZoneDrifting=yes」となっているので、それを無効化してください、ということのようです
現在のfirewalldの状態を確認
firewall-cmd --state
[root@SV-IXION ~]# firewall-cmd --state running
設定ファイル「firewalld.conf」の確認
cat /etc/firewalld/firewalld.conf
# firewalld config file # default zone # The default zone used if an empty zone string is used. # Default: public DefaultZone=public # Clean up on exit # If set to no or false the firewall configuration will not get cleaned up # on exit or stop of firewalld # Default: yes CleanupOnExit=yes # Lockdown # If set to enabled, firewall changes with the D-Bus interface will be limited # to applications that are listed in the lockdown whitelist. # The lockdown whitelist file is lockdown-whitelist.xml # Default: no Lockdown=no # IPv6_rpfilter # Performs a reverse path filter test on a packet for IPv6. If a reply to the # packet would be sent via the same interface that the packet arrived on, the # packet will match and be accepted, otherwise dropped. # The rp_filter for IPv4 is controlled using sysctl. # Default: yes IPv6_rpfilter=yes # IndividualCalls # Do not use combined -restore calls, but individual calls. This increases the # time that is needed to apply changes and to start the daemon, but is good for # debugging. # Default: no IndividualCalls=no # LogDenied # Add logging rules right before reject and drop rules in the INPUT, FORWARD # and OUTPUT chains for the default rules and also final reject and drop rules # in zones. Possible values are: all, unicast, broadcast, multicast and off. # Default: off LogDenied=off # FirewallBackend # Selects the firewall backend implementation. # Choices are: # - nftables (default) # - iptables (iptables, ip6tables, ebtables and ipset) FirewallBackend=nftables # FlushAllOnReload # Flush all runtime rules on a reload. In previous releases some runtime # configuration was retained during a reload, namely; interface to zone # assignment, and direct rules. This was confusing to users. To get the old # behavior set this to "no". # Default: yes FlushAllOnReload=yes # RFC3964_IPv4 # As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that # correspond to IPv4 addresses that should not be routed over the public # internet. # Defaults to "yes". RFC3964_IPv4=yes # AllowZoneDrifting # Older versions of firewalld had undocumented behavior known as "zone # drifting". This allowed packets to ingress multiple zones - this is a # violation of zone based firewalls. However, some users rely on this behavior # to have a "catch-all" zone, e.g. the default zone. You can enable this if you # desire such behavior. It's disabled by default for security reasons. # Note: If "yes" packets will only drift from source based zones to interface # based zones (including the default zone). Packets never drift from interface # based zones to other interfaces based zones (including the default zone). # Possible values; "yes", "no". Defaults to "yes". AllowZoneDrifting=yes
最後の行に、AllowZoneDrifting=yes とあるので、
ここを変更します。
「firewalld.conf」のバックアップ
cp -p /etc/firewalld/firewalld.conf /etc/firewalld/firewalld.conf.original_bk
[root@SV-IXION ~]# cp -p /etc/firewalld/firewalld.conf /etc/firewalld/firewalld.conf.original_bk [root@SV-IXION ~]# ls -l /etc/firewalld/firewalld.conf* -rw-r--r--. 1 root root 2747 11月 5 19:51 /etc/firewalld/firewalld.conf -rw-r--r-- 1 root root 2747 11月 5 19:51 /etc/firewalld/firewalld.conf.original_bk
「firewalld.conf」の編集
vi /etc/firewalld/firewalld.conf
# AllowZoneDrifting # Older versions of firewalld had undocumented behavior known as "zone # drifting". This allowed packets to ingress multiple zones - this is a # violation of zone based firewalls. However, some users rely on this behavior # to have a "catch-all" zone, e.g. the default zone. You can enable this if you # desire such behavior. It's disabled by default for security reasons. # Note: If "yes" packets will only drift from source based zones to interface # based zones (including the default zone). Packets never drift from interface # based zones to other interfaces based zones (including the default zone). # Possible values; "yes", "no". Defaults to "yes". AllowZoneDrifting=no
最後の行を、AllowZoneDrifting=no に変更しました。
firewalldの再起動
systemctl restart firewalld
systemctl status firewalld
[root@SV-IXION ~]# systemctl restart firewalld [root@SV-IXION ~]# systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor p> Active: active (running) since Sun 2020-12-20 11:27:31 JST; 4s ago Docs: man:firewalld(1) Main PID: 5647 (firewalld) Tasks: 2 (limit: 10624) Memory: 23.3M CGroup: /system.slice/firewalld.service mq5647 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork > 12月 20 11:27:31 SV-IXION systemd[1]: firewalld.service: Succeeded. 12月 20 11:27:31 SV-IXION systemd[1]: Stopped firewalld - dynamic firewall daem> 12月 20 11:27:31 SV-IXION systemd[1]: Starting firewalld - dynamic firewall dae> 12月 20 11:27:31 SV-IXION systemd[1]: Started firewalld - dynamic firewall daem>
