Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to install UFW on Debian Lenny. Everything looks straightforward except that I don't know where to plug UFW startup script so that it configures iptables before hax0rs can break in.

I've reviewed runlevel directories and in /etc/rc0.d, /etc/rc6.d and /etc/rcS.d there are items like these:

S35networking -> ../init.d/networking
S36ifupdown -> ../init.d/ifupdown

Runlevel 0 and 6 are for shutdown and reboot so I guess nothing should be changed there, but runlevel S advertises itself (in README) like something for me:

The scripts in this directory whose names begin with an 'S' are executed
once when booting the system, even when booting directly into single user
mode.


The following sequence points are defined at this time:

* After the S40 scripts have executed, all local file systems are mounted
  and networking is available. All device drivers have been initialized.

(What bothers me is that both rc0/6.d and rcS.d point to the same networking and ifupdown scripts, but after looking at sources I believe those scripts are smart enough to figure out where to start and where to stop networking.)

Now, I think that I should plug my /lib/ufw/ufw-init into /etc/rcS.d, with priority higher that the one of ifupdown and networking, i.e. <= 38 for my /etc/rcS.d.

Am I right in this "analysis" ?

share|improve this question
    
Actually this fits ServerFault more than Superuser.. –  Tomasz Zieliński Feb 23 '11 at 15:33
add comment

1 Answer

up vote 2 down vote accepted

When running rc0.d and rc6.d, init calls stop operation for scripts. That way script knows whether it should start or stop.

At least in my Debian there is /etc/rcS.d/S14ufw, which starts at the same time with interfaces (S14networking). If that's problem (there may be really short time with interfaces up and firewall down), you can move it to S13ufw, for example, in rcS.d.

You may want to take look at man update-rc.d also.

share|improve this answer
    
Thanks again! I'm on Debian Lenny which doesn't have UFW in its repositories, so I have to install it manually. BTW I don't have any problems even without UFW because I only have two ports open, but I want to cut out all the sshd login attempts etc. –  Tomasz Zieliński Feb 23 '11 at 14:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.