From 40e43c925453efc294a0ac9b37e92c64e8e54b4b Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Wed, 21 Jan 2026 18:46:37 -0600 Subject: fix(archsetup): add firewall validation with critical warning - Verify ufw is active after setup completes - Display critical security warning in outro if firewall not active - Include manual fix commands in warning message --- archsetup | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'archsetup') diff --git a/archsetup b/archsetup index 177afcc..8cb5db6 100755 --- a/archsetup +++ b/archsetup @@ -105,6 +105,7 @@ archsetup_packages="/var/log/archsetup-installed-packages.txt" min_disk_space_gb=20 state_dir="/var/lib/archsetup/state" error_messages=() +firewall_verified=false ### Cleanup Trap # Ensures tmpfs is unmounted if script exits unexpectedly @@ -847,6 +848,14 @@ EOF action="starting firewall service" && display "task" "$action" systemctl start ufw.service >> "$logfile" 2>&1 || error "error" "$action" "$?" + # Verify firewall is actually active + action="verifying firewall is active" && display "task" "$action" + if ufw status | grep -q "Status: active"; then + firewall_verified=true + else + error "error" "firewall verification failed - ufw is not active" "1" + fi + # Service Discovery display "subtitle" "Network Service Discovery" @@ -1697,6 +1706,18 @@ outro() { done fi + # Critical security warning if firewall setup failed + if [ "$firewall_verified" != "true" ]; then + printf "\n" | tee -a "$logfile" + printf "!!! CRITICAL SECURITY WARNING !!!\n" | tee -a "$logfile" + printf "!!! FIREWALL IS NOT ACTIVE !!!\n" | tee -a "$logfile" + printf "Your system may be unprotected. Please run these commands manually:\n" | tee -a "$logfile" + printf " sudo ufw default deny incoming\n" | tee -a "$logfile" + printf " sudo ufw enable\n" | tee -a "$logfile" + printf " sudo ufw status\n" | tee -a "$logfile" + printf "\n" | tee -a "$logfile" + fi + printf "\n" printf "Please reboot before working with your new workstation.\n\n" -- cgit v1.2.3