Detections
Analytics

4.1.3 Ensure firewalld.service is configured

Information

firewalld.service is a firewall service daemon that provides a dynamic, customizable firewall with a D-Bus interface.

firewalld.service must be active to enforce rules configured through FirewallD. firewalld.service must be enabled to start automatically after a system reboot.

Solution

Run the following commands to unmask, enable, and start firewalld.service :

# systemctl unmask firewalld.service
# systemctl --now enable firewalld.service

Impact:

Enabling and starting firewalld.service activates host-based packet filtering: from that point, incoming traffic is evaluated against the applicable zone and any traffic that is not permitted is blocked. Ensure the services and ports required for the system's role - including remote administration such as SSH - are allowed, or connectivity to the system can be affected.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: c288727e49ba5fa4e38b74431d59e5f0d5351e80c65bbf7c926c6d4be49ceae7