3.5.3.1.3 Ensure firewalld is not installed or stopped and masked

Information

firewalld (Dynamic Firewall Manager) provides a dynamically managed firewall with support for network/firewall "zones" to assign a level of trust to a network and its associated connections, interfaces or sources. It has support for IPv4, IPv6, Ethernet bridges and also for IPSet firewall settings. There is a separation of the runtime and permanent configuration options.

Running iptables.service andor ip6tables.service with firewalld.service may lead to conflict and unexpected results.

Solution

Run the following command to remove firewalld

# zypper remove firewalld

OR

Run the following command to stop and mask firewalld

# systemctl --now mask firewalld

See Also

https://workbench.cisecurity.org/files/3682

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|CM-6, 800-53|CM-7, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: f6086717f1220cbddc489af353c59f908e7287817f85fe53122f0da6b847f647