Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[4.3.0] Mising option to disable AllowZoneDrifting #294

Closed
tuxmaster opened this issue May 21, 2020 · 3 comments
Closed

[4.3.0] Mising option to disable AllowZoneDrifting #294

tuxmaster opened this issue May 21, 2020 · 3 comments

Comments

@tuxmaster
Copy link

The exists no option in the firewalld class to disable AllowZoneDrifting.
So this warning will logged:

WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.

@zeekus
Copy link

zeekus commented Aug 6, 2020

It appears the 'AllowZoneDrifting' is stored in the firewalld.conf file on Centos8. Here is a copy:

# AllowZoneDrifting
# Older versions of firewalld had undocumented behavior known as "zone
# drifting". This allowed packets to ingress multiple zones - this is a
# violation of zone based firewalls. However, some users rely on this behavior
# to have a "catch-all" zone, e.g. the default zone. You can enable this if you
# desire such behavior. It's disabled by default for security reasons.
# Note: If "yes" packets will only drift from source based zones to interface
# based zones (including the default zone). Packets never drift from interface
# based zones to other interfaces based zones (including the default zone).
# Possible values; "yes", "no". Defaults to "yes".
AllowZoneDrifting=yes


@tuxmaster5000
Copy link

On the current version the setting can changed.

@kenyon
Copy link
Member

kenyon commented Dec 12, 2020

Fixed by #301.

@kenyon kenyon closed this as completed Dec 12, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants