ufw loglevels don't log after reboot
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
ufw |
Fix Released
|
High
|
Jamie Strandboge | ||
ufw (Ubuntu) |
Fix Released
|
High
|
Jamie Strandboge | ||
Jaunty |
Won't Fix
|
High
|
Jamie Strandboge | ||
Karmic |
Won't Fix
|
High
|
Jamie Strandboge | ||
Lucid |
Fix Released
|
High
|
Jamie Strandboge |
Bug Description
Binary package hint: ufw
ufw performs per-rule logging just fine, and it will perform logging after performing a 'ufw disable ; ufw enable', but does not add the necessary logging rules with ufw-init after a reboot. Eg:
$ diff ./save_after_start ./save_after_enable
...
73a74,75
> -A ufw-after-
> -A ufw-after-
91a94,95
> -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
> -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
ProblemType: Bug
Architecture: amd64
Date: Sat Oct 24 13:07:22 2009
DistroRelease: Ubuntu 9.10
Package: ufw 0.29-4ubuntu1 [modified: lib/ufw/ufw-init]
PackageArchitec
ProcEnviron:
PATH=(custom, user)
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcVersionSign
SourcePackage: ufw
Uname: Linux 2.6.31-14-generic x86_64
Changed in ufw (Ubuntu Jaunty): | |
status: | New → Triaged |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in ufw (Ubuntu Karmic): | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in ufw (Ubuntu Jaunty): | |
importance: | Undecided → High |
Changed in ufw (Ubuntu Karmic): | |
milestone: | none → karmic-updates |
Changed in ufw (Ubuntu Jaunty): | |
milestone: | none → jaunty-updates |
Changed in ufw: | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in ufw: | |
status: | Triaged → Fix Committed |
summary: |
- ufw not logging packets against default policy after reboot + ufw loglevels don't log after reboot |
tags: | removed: amd64 apport-bug |
TEST CASE
$ sudo iptables-save|grep '^-.*logging' | wc -l .*/ENABLED= yes/" /etc/ufw/ufw.conf
12
$ sudo ufw disable
$ sudo sed -i "s/^ENABLED=
$ sudo /lib/ufw/ufw-init start
8
While the number of lines given by 'wc' will differ depending on the firewall configuration, the important thing is they should be the same. The above shows an unpatched ufw.