mediumnetworkverified ✓

Ensure a single firewall configuration utility is in use

firewall-single-utility · RHEL ≥ 8 · 1 impl

Description

Only one firewall management utility should be active to prevent conflicts and ensure consistent firewall rules.

Rationale

Running multiple firewall utilities can lead to conflicting rules and unpredictable behavior. Either firewalld OR nftables should be used, not both simultaneously.

Check → Remediate

Checkcommand

# Count active firewall services
count=0
systemctl is-active firewalld >/dev/null 2>&1 && count=$((count+1))
systemctl is-active nftables >/dev/null 2>&1 && count=$((count+1))

if [ $count -eq 0 ]; then
  echo "FAIL: No firewall utility is active"
  exit 1
elif [ $count -gt 1 ]; then
  echo "FAIL: Multiple firewall utilities are active"
  exit 1
fi
echo "OK: Single firewall utility in use"
exit 0

expected_exit:: 0

Remediatemanual

note:: Enable either firewalld or nftables, not both. Disable the unused service.

Framework references

CIS

rhel9 4.1.2

NIST 800-53

SC-7CM-6

Live verification

rhel9:check

#firewall#nftables#firewalld#security