3.5.2.2 Ensure firewalld is either not installed or masked with nftables - masked

Information

firewalld (Dynamic Firewall Manager) provides a dynamically managed firewall with support for network/firewall 'zones' to assign a level of trust to a network and its associated connections, interfaces or sources. It has support for IPv4, IPv6, Ethernet bridges and also for IPSet firewall settings. There is a separation of the runtime and permanent configuration options.

Rationale:

Running both nftables.service and firewalld.service may lead to conflict and unexpected results.

Solution

Run the following command to remove firewalld

# yum remove firewalld

OR
Run the following command to stop and mask firewalld

# systemctl --now mask firewalld

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|CM-6, 800-53|CM-7, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 51421edb3fa4de15a808b548ab092f585ad9308f7c3aab01bb1f3d9ae14d233a