4.1.1 Ensure a single firewall configuration utility is in use

Audit

Run the following script to verify that a single firewall utility is in use on the system:

#!/usr/bin/env bash
{
active_firewall=() firewalls=("ufw" "nftables" "iptables")
# Determine which firewall is in use
for firewall in "${firewalls[@]}"; do
case $firewall in
nftables)
cmd="nft" ;;
*)
cmd=$firewall ;;
esac
if command -v $cmd &> /dev/null && systemctl is-enabled --quiet
$firewall && systemctl is-active --quiet $firewall; then
active_firewall+=("$firewall")
fi
done
# Display audit results
if [ ${#active_firewall[@]} -eq 1 ]; then
printf '%s\n' "" "Audit Results:" " ** PASS **" " - A single firewall is in use follow the recommendation in ${active_firewall[0]} subsection ONLY"
elif [ ${#active_firewall[@]} -eq 0 ]; then
printf '%s\n' "" " Audit Results:" " ** FAIL **" "- No firewall in use or unable to determine firewall status"
else
printf '%s\n' "" " Audit Results:" " ** FAIL **" " - Multiple firewalls are in use: ${active_firewall[*]}"
fi
}

Remediation

Remediating to a single firewall configuration is a complex process and involves several steps. The following provides the basic steps to follow for a single firewall configuration: 1. Determine which firewall utility best fits organizational needs 2. Follow the recommendations in the subsequent subsection for the single firewall to be used Note: Review the firewall subsection overview for the selected firewall to be used, it contains a script to simplify this process. 3. Return to this recommendation to ensure a single firewall configuration utility is in use

apt install ufw