The system firewall is not opened, and there is a security risk

asyermai2303

Sory im not understand the instruction solution, can it be more detailed for the solving that security risk

aaPanel_Jose

asyermai2303
Please check if your firewall is enable
centos
systemctl status firewalld
enable firewalld
systemctl start firewalld
ubuntu
ufw status|grep 'Status: active'
enable firewalld
systemctl start ufw

guliman

I have ubuntu 20 and working SYS Firewall 2.7 plugin setted with open ports (it really closed other ports). But i don't have ufw or other firewall installed manually.

Do i need to install ufw manually and will have 2 firewalls or what?
# ufw status bash: ufw: command not found

aaPanel_Kern

guliman
Hello, please check whether ufw is installed normally on the server?
apt install ufw

guliman

# apt install ufw Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: liblockfile-bin liblockfile1 lockfile-progs sendmail-base sensible-mda Use 'apt autoremove' to remove them. The following NEW packages will be installed: ufw 0 upgraded, 1 newly installed, 0 to remove and 108 not upgraded. Need to get 147 kB of archives. After this operation, 849 kB of additional disk space will be used. Get:1 http://us.archive.ubuntu.com/ubuntu focal-updates/main amd64 ufw all 0.36-6ubuntu1 [147 kB] Fetched 147 kB in 1s (259 kB/s) Preconfiguring packages ... Selecting previously unselected package ufw. (Reading database ... 100288 files and directories currently installed.) Preparing to unpack .../ufw_0.36-6ubuntu1_all.deb ... Unpacking ufw (0.36-6ubuntu1) ... Setting up ufw (0.36-6ubuntu1) ... Creating config file /etc/ufw/before.rules with new version Creating config file /etc/ufw/before6.rules with new version Creating config file /etc/ufw/after.rules with new version Creating config file /etc/ufw/after6.rules with new version Created symlink /etc/systemd/system/multi-user.target.wants/ufw.service → /lib/systemd/system/ufw.service. Processing triggers for rsyslog (8.2001.0-1ubuntu1.3) ... Processing triggers for systemd (245.4-4ubuntu3) ...
and:
# ufw status Status: inactive

default rules in /etc/ufw/user.rules;
i've added one rule for aaPanel's port, then:
# sudo ufw enable Command may disrupt existing ssh connections. Proceed with operation (y|n)? y Firewall is active and enabled on system startup
then retest security check in aaPanel was good = problem solved;

then i've restarted SYS Firewall 2.7 in aaPanel. restarted normally.
but got this one again:
# sudo ufw status Status: inactive

and then retest security check in aaPanel was good = problem back;

Check whether the system firewall is enable（Checked: 8minutes ago, time: 99.29ms）

aaPanel_Kern

guliman
Hello, it is recommended to check whether there is a shutdown in the system
Check the ufw service status, boot up, start ufw
systemctl status ufw systemctl enable ufw systemctl start ufw

guliman

thank you.
it works, but should be add ufw rule for ssh.
all rules in SYS Firewall 2.7 should be 'Edit' -> 'Confirm', then be applied to ufw

btw, have an error
{"status": false, "msg": "CSRF calibration failed, please login again"}
at:

/firewall/get_file?filename=/www/server/panel/plugin/firewall/port.json

clicking to 'Export rules' in SYS Firewall 2.7

aaPanel_Kern

guliman
Hello, this is a known issue. Please wait for our fix.

aaP_gustavobuitron

allright..