diff options
Diffstat (limited to 'archsetup')
| -rwxr-xr-x | archsetup | 21 |
1 files changed, 21 insertions, 0 deletions
@@ -105,6 +105,7 @@ archsetup_packages="/var/log/archsetup-installed-packages.txt" min_disk_space_gb=20 state_dir="/var/lib/archsetup/state" error_messages=() +firewall_verified=false ### Cleanup Trap # Ensures tmpfs is unmounted if script exits unexpectedly @@ -847,6 +848,14 @@ EOF action="starting firewall service" && display "task" "$action" systemctl start ufw.service >> "$logfile" 2>&1 || error "error" "$action" "$?" + # Verify firewall is actually active + action="verifying firewall is active" && display "task" "$action" + if ufw status | grep -q "Status: active"; then + firewall_verified=true + else + error "error" "firewall verification failed - ufw is not active" "1" + fi + # Service Discovery display "subtitle" "Network Service Discovery" @@ -1697,6 +1706,18 @@ outro() { done fi + # Critical security warning if firewall setup failed + if [ "$firewall_verified" != "true" ]; then + printf "\n" | tee -a "$logfile" + printf "!!! CRITICAL SECURITY WARNING !!!\n" | tee -a "$logfile" + printf "!!! FIREWALL IS NOT ACTIVE !!!\n" | tee -a "$logfile" + printf "Your system may be unprotected. Please run these commands manually:\n" | tee -a "$logfile" + printf " sudo ufw default deny incoming\n" | tee -a "$logfile" + printf " sudo ufw enable\n" | tee -a "$logfile" + printf " sudo ufw status\n" | tee -a "$logfile" + printf "\n" | tee -a "$logfile" + fi + printf "\n" printf "Please reboot before working with your new workstation.\n\n" |