Upgrading from CentOS 6.2 to RHEL 7.3
Upgrading from CentOS 6.2 to RHEL 7.3:
CentOS 6.2 uses iptables for firewall.
1) If iptables-services are NOT installed on RHEL 7.3, will the firewall still work if firewalld is disabled after you have imported the old iptables from CentOS 6.2?
2) Would /etc/hosts.allow and /etc/hosts.deny be able to act as a firewall if neither firewall (firewalld or iptables) is running?
Responses
Hello, please note that upgrading from CentOS to RHEL is not supported. See Red Hat Knowledgebase solution Can I upgrade or convert a CentOS system into a RHEL system.
The Using Firewalls section of the Red Hat Enterprise Linux 7 Security Guide might be of interest. It explains how iptables and firewalld fit together.
Randall,
Are you referring to an in place upgrade? Even if both the OS's were Red Hat, upgrade from major versions is very limited and is only really supported for limited cases of 6 -> 7 upgrades, details here:
https://access.redhat.com/solutions/21964
1) This seems like a strange constraint. If you have iptables in EL6, why wouldn't you migrate that iptables configuration to your RHEL 7 instance and use iptables that ships with RHEL 7 to implement these rules? You can disable firewalld and just run the standard iptables configuration in RHEL 7 (with your existing ruleset).
2) TCP wrappers (hosts.allow / hosts.deny) is not a full firewall implementation. You need to be sure that the services that you are 'protecting' support TCP wrappers, or are configured to use TCP wrappers (there are steps to confirm this).
1.) The "iptables-services" is just a collection of scripts and systemd service files that will use the "iptables-restore" command to read the previously saved iptables firewall settings from /etc/sysconfig/iptables and /etc/sysconfig/ip6tables files and to feed them into the iptables/netfilter subsystem of the Linux kernel.
It is entirely possible to set up the firewall by using an arbitrary script that runs either the "iptables-restore" command or a set of plain "iptables" commands to load the firewall rules.
If the original firewall rules have just been imported with a manual iptables-restore command, then the firewall rules are currently in effect, but they will be gone after the system is rebooted.
Before making your changes, you might want to run something like this:
# iptables-save >/root/iptables.backup
# ip6tables-save >/root/ip6tables.backup
Then you can make the necessary changes using the "iptables" command, and then make another set of backups to different files, e.g. /root/iptables.new and /root/ip6tables.new.
Then start solving the mystery of "does this system load the firewall rules at all at boot time, and if so, where from?" at your leisure. Until you figure that out, if the system gets rebooted, you can definitely reload the original rules with:
# iptables-restore </root/iptables.backup
# ip6tables-restore </root/ip6tables.backup
or your modified rules with:
# iptables-restore </root/iptables.new
# ip6tables-restore </root/ip6tables.new
2.) /etc/hosts.allow and /etc/hosts.deny only work with services that use tcpwrapper (tcpd) or are compiled to use the libwrap library, or are started through a mechanism (like xinetd) that fulfills the same conditions. Specifically, web servers and most Java-based server applications will normally completely ignore /etc/hosts.* files.
Yes, the /etc/hosts.allow and /etc/hosts.deny can sort of do the basic job of a firewall. But at least to me, a true firewall means a network access control system that is separate from the software asset it is expected to protect. A firewall can protect a J2EE server or a web server even if you completely mess up the configuration of that server - for /etc/hosts.allow and /etc/hosts.deny, there is no such certainty.
Randall,
If you want the same iptables functionality as in EL6, disable firewalld completely (which may well have been done by the previous admin) either by uninstalling the package or masking the service
systemctl mask firewalld
systemctl stop firewalld
Then enable and start the iptables service (and ip6tables if you're using it)
yum install -y iptables-services
systemctl enable iptables
systemctl start iptables
Copy your rules over to /etc/sysconfig/iptables and restart the service (or reboot to confirm). I haven't had issues with this process, please let me know if you encounter any.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.