[Bug 1198984] New: firewalld: please improve documentation on using it on a RedHat/Fedora/CentOS router
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1198984
Bug ID: 1198984
Summary: firewalld: please improve documentation on using it on
a RedHat/Fedora/CentOS router
Product: Fedora Documentation
Version: devel
Component: cookbook
Assignee: docs(a)lists.fedoraproject.org
Reporter: razvan.sandu(a)mobexpert.ro
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: docs(a)lists.fedoraproject.org
Hello,
Description of problem:
Even using the rich-language feature, it is still rather difficult to figure
out
how to use firewalld on a RedHat/Fedora/CentOS system that is used as a router
(a "transparent" system).
That's because:
a. administrators will need *different* sets of rules/restrictions for access
to the router itself and to the various services that run beyond the router
(using or non using NAT).
b. It is not very clear how/where the predefined firewalld zones implement
their policies (ACCEPT or DROP) and when these policies apply to traffic
bounded *to* the router system or to traffic that *traverses* the router.
For example, an administrator needs an *easy* method to restrict VNC access
*to* the router itself (INPUT), but may want free VNC access to some server
located *behind* the router (FORWARD). In the second case, forwarding may (or
may not) imply NAT, depending if he goes on the Internet via the external
interface or simply goes in another LAN segment beyond the router.
c. It is not very clear how/where the predefined firewalld zones implement
their trafic rules ( *exceptions* to ACCEPT or DROP default policies) and when
these rules apply to traffic bounded *to* the router system or to traffic that
*traverses* the router.
Additional info:
Even it is not dynamic, the Shorewall application (http://shorewall.net/) acts
as a higher-level language over iptables, offering the same concepts of "zones"
for interfaces. Much of its conceptual architecture is directly applicable
("portable") to firewalld, if accepted by developers.
Somewhat different from conceptual point of view, the "zones" are "levels of
trust surrounding the router", including thr FW zone for the router itself.
(unlike firewalld, the shorewall zones have no "sources" or "services" embedded
in them).
IPv4 and IPv6 zones are completely separated (they actually represent different
levels of trust).
Administrators may directly define policies, i.e. allow *default* actions to be
done when an packet travels from a zone to another (ACCEPT, REJECT). The most
sane policy between any two zones is REJECT (with further exceptions defined as
rules, see below).
Rules are *exceptions to policies* , explicitly defined (based on various
criteria such as source IP, destination IP, ports, etc.)
Rules may be expressed via predefined (or customised) "macros" (which are the
direct equivalent of firewalld's "services").
IPv4 and IPv6 policy and rules are completely separated (IMHO that's good,
since the use of global IPv6 addresses pose completely different security
problems than NATted & externally firewalled IPv4).
Best regards,
Răzvan
--
You are receiving this mail because:
You are the QA Contact for the bug.
6 years, 7 months
[Bug 1008227] New: SSD cache
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1008227
Bug ID: 1008227
Summary: SSD cache
Product: Fedora Documentation
Version: devel
Component: docs-requests
Keywords: Tracking
Assignee: nobody(a)fedoraproject.org
Reporter: me(a)petetravis.com
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: agk(a)redhat.com, i.gnatenko.brain(a)gmail.com,
jeremy(a)goop.org, jreznik(a)redhat.com, kzak(a)redhat.com,
nobody(a)fedoraproject.org, rdieter(a)math.unl.edu,
rolf(a)rolffokkens.nl, sparks(a)redhat.com,
stickster(a)gmail.com, zach(a)oglesby.co
Depends On: 998543, 999690, 1000817, 1001120, 1003208, 1000078,
1003207
+++ This bug was initially created as a clone of Bug #998543 +++
This is a tracking bug for Change: SSD cache
For more details, see: http://fedoraproject.org//wiki/Changes/SSD_cache
Using recent kernel (3.9 and later) features for (fast) SSD caching of (slow)
ordinary hard disks.
--- Additional comment from Rolf Fokkens on 2013-08-21 13:35:33 EDT ---
I'll build a bcache-tools RPM and a dm-cache-utils rpm (actually bcache-tools
is already available here: bcache-tools-20130820-0.1.fc19.src.rpm).
I'll follow the procedure as described here:
https://fedoraproject.org/wiki/Join_the_package_collection_maintainers
--- Additional comment from Rolf Fokkens on 2013-08-24 11:51:34 EDT ---
Tried to create a dmcache-utils package as well (Bug 1000078) but it doesn't
look really useful. So I'll focus on bcache-tools first. For that I still need
a sponsor.
--- Additional comment from Rolf Fokkens on 2013-08-27 06:52:40 EDT ---
I closed Bug 1000078 since good userland support requires LVM2 to support
dm-cache. Which will happen 'in the future', but F20 doesn't look feasible to
me.
--- Additional comment from Rolf Fokkens on 2013-08-31 16:21:30 EDT ---
Create Bug 1003207 (bcache support for dracut) which is not blocking for F20,
but probably will be blocking for F21.
--- Additional comment from Rolf Fokkens on 2013-08-31 16:25:06 EDT ---
Create Bug 1003208 (bcache support for anaconda) which is not blocking for F20,
but probably will be blocking for F21.
--- Additional comment from Rolf Fokkens on 2013-09-09 04:18:18 EDT ---
Test day planned: https://fedorahosted.org/fedora-qa/ticket/415
--------------------------------------------------------------
Discussion at
https://lists.fedoraproject.org/pipermail/devel/2013-July/185336.html
Please assess existing documentation for the impact of this Change.
--
You are receiving this mail because:
You are the QA Contact for the bug.
6 years, 8 months
[Bug 1095977] New: RFE: static IP assignment
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1095977
Bug ID: 1095977
Summary: RFE: static IP assignment
Product: Fedora Documentation
Version: devel
Component: cookbook
Assignee: docs(a)lists.fedoraproject.org
Reporter: me(a)petetravis.com
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: docs(a)lists.fedoraproject.org
Static IP addresses are crucial for applications like DHCP servers or other
infrastructure that can't rely on external assignment. They're also helpful for
home users that want to predictably locate their Fedora installation.
Explain the use case for this and some alternative methods, then the procedure
for setting a setting a static IP using both ifcfg files and graphical methods.
Each method could be explained in a separate article; ie "... on the command
line" and "... with GNOME" and "... with KDE" and so on.
--
You are receiving this mail because:
You are the QA Contact for the bug.
6 years, 8 months
[Bug 1101798] New: RFE: Captive portal
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1101798
Bug ID: 1101798
Summary: RFE: Captive portal
Product: Fedora Documentation
Version: devel
Component: cookbook
Assignee: docs(a)lists.fedoraproject.org
Reporter: me(a)petetravis.com
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: docs(a)lists.fedoraproject.org
Create a recipe for configuring a simple captive portal with Fedora that will
require users to acknowledge a terms of use message before allowing connections
to pass.
--
You are receiving this mail because:
You are the QA Contact for the bug.
6 years, 8 months
[Bug 1101796] New: RFE: NAT router
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1101796
Bug ID: 1101796
Summary: RFE: NAT router
Product: Fedora Documentation
Version: devel
Component: cookbook
Assignee: docs(a)lists.fedoraproject.org
Reporter: me(a)petetravis.com
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: docs(a)lists.fedoraproject.org
Create a recipe for using Fedora as a NAT router using Firewalld and
NetworkManager.
--
You are receiving this mail because:
You are the QA Contact for the bug.
6 years, 8 months
[Bug 1096394] New: RFE: Thin Client (Tracking Bug)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1096394
Bug ID: 1096394
Summary: RFE: Thin Client (Tracking Bug)
Product: Fedora Documentation
Version: devel
Component: cookbook
Assignee: docs(a)lists.fedoraproject.org
Reporter: me(a)petetravis.com
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: docs(a)lists.fedoraproject.org
Fedora can be used as a server and client environment for a thin client
deployment. Document the required procedures to do this.
Because of the broad scope and number of procedures involved, this should be
split up into recipes addressing component tasks. This bug will be used to
track the overall progress; please block this bug with any new bugs created for
the purpose.
--
You are receiving this mail because:
You are the QA Contact for the bug.
6 years, 8 months
[Bug 1095945] New: RFE: disabling head parking on spinning drives
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1095945
Bug ID: 1095945
Summary: RFE: disabling head parking on spinning drives
Product: Fedora Documentation
Version: devel
Component: cookbook
Assignee: docs(a)lists.fedoraproject.org
Reporter: me(a)petetravis.com
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: docs(a)lists.fedoraproject.org
Some drives have aggressive APM, and the resulting frequent head parking can
negatively impact access latency and produce an annoying clicking sound.
Explain the theory, benefits, procedure, and risks of adjusting APM settings
with hdparm.
--
You are receiving this mail because:
You are the QA Contact for the bug.
6 years, 8 months