Run the following script to ensure that a single firewall utility is in use on the system: #!/usr/bin/env bash { l_output="" l_output2="" l_fwd_status="" l_nft_status="" l_fwutil_status="" # Determine FirewallD utility Status rpm -q firewalld > /dev/null 2>&1 && l_fwd_status="$(systemctl is-enabled firewalld.service):$(systemctl is-active firewalld.service)" # Determine NFTables utility Status rpm -q nftables > /dev/null 2>&1 && l_nft_status="$(systemctl is-enabled nftables.service):$(systemctl is-active nftables.service)" l_fwutil_status="$l_fwd_status:$l_nft_status" case $l_fwutil_status in enabled:active:masked:inactive|enabled:active:disabled:inactive) echo -e " - FirewallD utility is in use, enabled and active - NFTables utility is correctly disabled or masked and inactive - no remediation required" ;; masked:inactive:enabled:active|disabled:inactive:enabled:active) echo -e " - NFTables utility is in use, enabled and active - FirewallD utility is correctly disabled or masked and inactive - no remediation required" ;; enabled:active:enabled:active) echo -e " - Both FirewallD and NFTables utilities are enabled and active - stopping and masking NFTables utility" systemctl stop nftables && systemctl --now mask nftables ;; enabled:*:enabled:*) echo -e " - Both FirewallD and NFTables utilities are enabled - remediating" if [ "$(awk -F: '{print $2}' <<< "$l_fwutil_status")" = "active" ] && [ "$(awk -F: '{print $4}' <<< "$l_fwutil_status")" = "inactive" ]; then echo " - masking NFTables utility" systemctl stop nftables && systemctl --now mask nftables elif [ "$(awk -F: '{print $4}' <<< "$l_fwutil_status")" = "active" ] && [ "$(awk -F: '{print $2}' <<< "$l_fwutil_status")" = "inactive" ]; then echo " - masking FirewallD utility" systemctl stop firewalld && systemctl --now mask firewalld fi ;; *:active:*:active) echo -e " - Both FirewallD and NFTables utilities are active - remediating" if [ "$(awk -F: '{print $1}' <<< "$l_fwutil_status")" = "enabled" ] && [ "$(awk -F: '{print $3}' <<< "$l_fwutil_status")" != "enabled" ]; then echo " - stopping and masking NFTables utility" systemctl stop nftables && systemctl --now mask nftables elif [ "$(awk -F: '{print $3}' <<< "$l_fwutil_status")" = "enabled" ] && [ "$(awk -F: '{print $1}' <<< "$l_fwutil_status")" != "enabled" ]; then echo " - stopping and masking FirewallD utility" systemctl stop firewalld && systemctl --now mask firewalld fi ;; :enabled:active) echo -e " - NFTables utility is in use, enabled, and active - FirewallD package is not installed - no remediation required" ;; :) echo -e " - Neither FirewallD or NFTables is installed. - remediating - installing NFTables" dnf -q install nftables ;; *:*:) echo -e " - NFTables package is not installed on the system - remediating - installing NFTables" dnf -q install nftables ;; *) echo -e " - Unable to determine firewall state" ;; esac }

Name	Audit Name	Plugin	Category
3.4.1.2 Ensure a single firewall configuration utility is in use	CIS AlmaLinux OS 8 Server L1 v3.0.0	Unix	SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION
3.4.1.2 Ensure a single firewall configuration utility is in use	CIS AlmaLinux OS 8 Workstation L1 v3.0.0	Unix	SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

Detections

Analytics

Item Search