Fedora 21 and its Workstation firewall

The Fedora 21 Workstation release came with a "feature" that was unexpected by some in the Fedora community. To those folks, the fact that the default firewall rules allow programs to listen and receive traffic on all non-privileged (> 1024) port numbers is a huge security hole, but to others it is precisely what was needed to support certain desktop use cases. Which reaction seems to depend on the person's expectations for the firewall—or for Fedora desktops.

Kevin Kofler raised the issue in early December. He noticed that the Workstation product configured the firewall to allow both UDP and TCP connections to ports 1025-65535. As is usual for Kofler, he didn't mince any words:

This configuration only affects one of the three products (i.e. the Workstation product) that the project delivered in the Fedora 21 release. That was the first release since the adoption of the product-focused Fedora.next strategy. The other two products have different firewall requirements, so the Server product has a much more locked-down firewall, while the Cloud product has no firewall at all since it is envisioned to be deployed in situations where network filtering is handled by another layer.

The reaction to Kofler's posting was mixed. Paul Howarth pointed out that the Release Notes did mention that the firewall is "developer oriented":

The notes go on to describe where to get more information along with a recommendation for the firewall-config package if a GUI tool to manage the configuration is needed. But, as Ian Malone noted, developers are likely already able to configure their firewalls if they need to, so the developer-oriented firewall really boils down to one that allows connectivity for consumer-oriented devices. That makes this change "feel rather like a fedora-no-longer-has-your-back moment", he said. Harald Reindl agreed, saying that "people switched to Linux systems to go in the 'secure by default' direction" but that, sadly, those times are gone.

Others, including some of the project members responsible for the change, disagreed. For some time now, Bastien Nocera has searched for some way to do media and file sharing without users having to fiddle with the firewall configuration. After some discussions in mid-2014, he posted a plan to the Fedora Desktop mailing list (which is where Workstation changes are usually discussed) in June. The implementation of that plan have just now appeared in the F21 Workstation release.

It should be noted that no services on high ports are started by the default installation of F21 Workstation. If users choose to enable sharing of media or files (using WebDAV or Rygel, for example), servers using high ports may be started and the firewall will not get in their way. Based on Nocera's posts, it seems clear that sharing between workstations was the main target of the feature.

In the past, the firewall configuration problem might have been handled by querying the user, or by having them set a particular firewall zone. According to Nocera and others, though, asking users security questions is a bad user interface choice. Instead, if the user chooses to share data (using the GNOME sharing dialog described in Nocera's blog post, for example), the network they are currently on is determined "safe" for sharing. New networks, or those that use unsecured WiFi, are considered to be unsafe, so sharing is disabled in those cases.

While several in the thread said—often rather caustically—that developers should be able to reconfigure the firewall if needed, Richard Hughes disagreed. It is a matter of who is being targeted by the Workstation product; the working group made a particular choice there. In fact, he said, the changes will make his system more secure:

For the most part, the opponents of the change did not find the need for various sharing protocols to be able to open a variety of high ports to be at all compelling. But, as Michael Catanzaro pointed out, that is a use case that the Workstation working group has decided to support. "So your challenge is to find an alternative default that supports it: then we'll have more to talk about."

Trying to pass the feature off as one for developers, though, as the release notes do, when the proponents keep harping on the sharing use case, as Catanzaro, Nocera, Hughes, and others do, also bothers some. As Brian Wheeler put it:

There are ways for those who want more security to get it, of course. Stephen Gallagher posted multiple options depending on the level of security required (all the way up to "Reindl-level"). He also pointed out that buried inside the Network Manager "Identity" settings, there is a way to associate a particular zone with each connection. But, opponents of the change point out that the default could have been left as it was and those that needed or wanted the firewall to allow more ports could, instead, switch their zone.

In addition, it seems there is a difference of opinion about the course of the discussion between the Fedora firewall developers and proponents of loosening the firewall restrictions. Nocera touted the agreement of the firewall developers several times in the thread, but Thomas Woerner, one of those developers, had a rather different view. They went back and forth a few times, but Nocera was adamant that the firewall team had signed off on the changes—and that the changes did not really change the default security of the Workstation product in any case.

This is, of course, just the kind of dispute that will not result in any kind of consensus emerging. So, Kofler duly referred the matter to the Fedora Engineering Steering Committee (FESCo) for resolution. He would like to see an immediate security update to the Workstation product that closes all the high ports. He also claimed that the working group essentially ignored an earlier FESCo decision that disallowed disabling the firewall for the Workstation product and simply worked around it by gutting the firewall's protections.

FESCo took up the issue at its December 17 meeting, though it deferred a decision until its January 7 meeting since several of the principals (Nocera, Woerner, and firewall developer Miloslav Trmač) could not attend. Fedora project leader Matthew Miller did note, however, that he was unhappy with the tone of the FESCo ticket that, he said, implied some malfeasance on the part of the Workstation working group. From the discussion, it would seem unlikely that FESCo will require that the firewall configuration change.

The biggest problem here seems to be one of expectations. Some expect their media sharing to "just work" with Fedora Workstation, while others require a system that is largely locked-down by default. The former group generally plans to operate their systems in friendly environments, perhaps, while the other group is leery of that "friendly" designation. It is pretty hard to satisfy both with one set of defaults. Perhaps, as Miller suggested in the thread, those looking for a more locked-down Workstation should turn to the Fedora Netizen spin.