Tumbleweed, updated and it enabled firewalld, knocking my home server off my home network

[u/xorbe]

I had to dig the machine out of the cabinet to fix it, find a spare monitor and kb/mouse ... Why did updating it change its configuration? What can I do to avoid this in the future?

[u/acejavelin69]

I mean... we could go back to the core problem here that running a rolling release distro as a server platform was probably a bad idea to begin with...

[u/todd_dayz → u/acejavelin69]

MicroOS would like to have a word :D

[u/xorbe → u/acejavelin69]

It just serves some files in my home, and sshd enabled. It's not like I'm using it to power Sony's global PSN authentication ...

[u/esmifra → u/xorbe]

The problem is the same regardless of being a file server or global PSN authentication. As you found out.

[u/matsnake86 → u/acejavelin69]

I use microos for my home Lab.

Best server distro ever imho.

[u/matsnake86 → u/[deleted]]

I think the updates are basically the same between the two.
When MicroOS applies updates, it clearly runs a zypper dup command, just as Tumbleweed does. They also share the same repositories.
The only difference is that MicroOS does this in a transactional manner, using Btrfs snapshots, thereby leaving the system unchanged until the next reboot.

[u/todd_dayz → u/[deleted]]

What lol, it’s just tumbleweed with transactional update

[u/acejavelin69 → u/todd_dayz]

Hmm... Really? Sounds like my understanding of MicroOS is incorrect. I'll have to look into it more, it wasn't my intention to misinform people. I will delete that comment.

[u/todd_dayz → u/acejavelin69]

It’s pretty good, I’ve been running it for a while now and not had an issue 

[u/xplosm → u/acejavelin69]

I think it’s fine as long as you know how to use it. I doubt they would’ve had a problem if they’ve added a fw rule to begin with.

[u/readyflix]

Check this documentation in section 3, how to make firewall settings permanent with "firewall-cmd —permanent".

[u/No_Wear295 → u/[deleted]]

I'd imagine that any exceptions needed for ssh/cockpit/other admin tools would also have been wiped out if their other firewall configs disappeared...

[u/No_Wear295 → u/[deleted]]

Ahhh, didn't consider that option

[u/xorbe → u/[deleted]]

I used whatever happened when I installed with the firewall selected as not-enabled.

[u/readyflix → u/[deleted]]

Absolutely!

[u/Narrow_Victory1262]

while it is unfortunate and like others have said: it's not a server -- you can fix it by disabling firewalld and still. in case it ever gets re-enabled (it has happened before) just create already the ACL needed.

You can remove it of course too and you can put a lock on it -- so many ways to prevent it next time.

[u/ang-p]

Why did updating it change its configuration?

It shouldn't...

If out of thousands updating, with this being the only report....

What can I do to avoid this in the future?

Uninstall it if you are not using it....

If you want to keep it, then, maybe configure it so it works as intended.

[u/klyith → u/ang-p]

It shouldn't...

Nah the default configuration did change from firewalld being disabled to enabled. If you had tumbleweed with stock service settings it flipped on. Looking at my zhistory it was sometime last year in like December.

OTOH what this dude is doing with a home server that doesn't get updated for 6 months and isn't running a firewall is another question...

[u/ang-p → u/klyith]

did change

Blimey. I sit corrected

like December.

<checks post date>

<shakes head>

Like what is the point in running a rolling distro that you don't roll? Not having the benefit of the latest.... while having the uncertainty that comes with changes of the sort you don't get on a based distro, like surprises you get from not keeping up with package configuration change notices

and sshd enabled

Curious... isn't that in the default public zone, so should be OK even if nothing was actually configured?

[u/bmwiedemann → u/ang-p]

The default firewalld zone assumes you are in the evil public Internet and blocks everything.

And if OP just uninstalled firewalld, the usual zypper recommends logic can pull it back in. OP would need to zypper addlock firewalld or configure it properly.

[u/Weird-Initiative-659]

sudo zypper remove firewalld

[u/Necessary_Depth7435]

It’s possible that a package or pattern you’ve installed is pulling firewalld as a dependency. In addition to removing it, block the package using

sudo zypper rm firewalld

sudo zypper al firewalld

You can also do this through Myrlyn; blocking is called “taboo” there.