92 lines
4.0 KiB
EmacsLisp
92 lines
4.0 KiB
EmacsLisp
;;; Linux+ Lesson 120: Firewall review
|
|
;;;
|
|
;;; Review firewall ACLs, stateful behavior, firewalld, UFW, and IDS.
|
|
;;;
|
|
;;; This file is part of the Linux+ Learning project.
|
|
;;;
|
|
;;; Copyright (c) 2026, Scott C. MacCallum (scm@sdf.org).
|
|
;;;
|
|
;;; This program is free software: you can redistribute it and/or modify
|
|
;;; it under the terms of the GNU Affero General Public License as
|
|
;;; published by the Free Software Foundation, either version 3 of the
|
|
;;; License, or (at your option) any later version.
|
|
;;;
|
|
;;; This program is distributed in the hope that it will be useful,
|
|
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
;;; GNU Affero General Public License for more details.
|
|
;;;
|
|
;;; You should have received a copy of the GNU Affero General
|
|
;;; Public License along with this program. If not, see
|
|
;;; <https://www.gnu.org/licenses/>.
|
|
|
|
;;; Commentary:
|
|
|
|
;; Run with:
|
|
;;
|
|
;; M-x linuxplus-lesson-120
|
|
;;
|
|
;; This lesson displays text above an ansi-term practice buffer.
|
|
|
|
;;; Code:
|
|
|
|
(require 'term)
|
|
|
|
(defun linuxplus-lesson-120 ()
|
|
"Show Linux+ lesson 120 with a shell practice buffer."
|
|
(interactive)
|
|
(delete-other-windows)
|
|
(let ((buffer (get-buffer-create "*Linux+ Lesson 120*")))
|
|
(switch-to-buffer buffer)
|
|
(read-only-mode -1)
|
|
(erase-buffer)
|
|
(insert "Linux+ Lesson 120: Firewall review\n\n")
|
|
(insert "This lesson reviews firewall facts missed during book\n")
|
|
(insert "practice. Treat this as Linux+ study wording.\n\n")
|
|
(insert "Firewall basics:\n\n")
|
|
(insert " Firewalls use ACLs, inspect network packets, and use\n")
|
|
(insert " configuration files so rules can persist after restart.\n\n")
|
|
(insert "ACL means access control list. An ACL is a list of rules\n")
|
|
(insert "that allow or deny traffic based on details such as source,\n")
|
|
(insert "destination, protocol, port, or interface.\n\n")
|
|
(insert "Stateful firewall review:\n\n")
|
|
(insert " A stateless firewall checks each packet by rule only.\n")
|
|
(insert " A stateful firewall tracks connection state.\n")
|
|
(insert " Your review answer associates stateful firewalls with\n")
|
|
(insert " faster handling for established connections and with\n")
|
|
(insert " detecting whether packets are fragmented.\n\n")
|
|
(insert "firewalld runtime and permanent rules:\n\n")
|
|
(insert " firewalld can have runtime rules and permanent rules.\n")
|
|
(insert " Test changes at runtime first. After a successful test,\n")
|
|
(insert " make them permanent with super user privileges:\n\n")
|
|
(insert " sudo firewall-cmd --runtime-to-permanent\n\n")
|
|
(insert "UFW review:\n\n")
|
|
(insert " To view numbered UFW rules, use:\n\n")
|
|
(insert " sudo ufw status numbered\n\n")
|
|
(insert " Your review answer for blocking SSH is:\n\n")
|
|
(insert " sudo ufw deny 22/tcp\n\n")
|
|
(insert "IDS review:\n\n")
|
|
(insert " For this book item, remember DenyHosts and Fail2Ban\n")
|
|
(insert " as intrusion detection systems. The answer associates\n")
|
|
(insert " them with modifying /etc/hosts.deny.\n\n")
|
|
(insert "Real-world note: DenyHosts is strongly associated with\n")
|
|
(insert "/etc/hosts.deny. Fail2Ban is commonly configured to block\n")
|
|
(insert "attackers through firewall actions. For the book question,\n")
|
|
(insert "memorize the book's expected wording.\n\n")
|
|
(insert "Audio practice on GNU/Linux:\n\n")
|
|
(insert " espeak-ng 'Use firewall cmd runtime to permanent.'\n")
|
|
(insert " espeak 'Use sudo ufw status numbered.'\n")
|
|
(insert " espeak-ng 'Use sudo ufw deny twenty two slash tcp.'\n\n")
|
|
(insert "Practice below. Try sudo ufw status numbered if UFW is\n")
|
|
(insert "installed, or review firewall-cmd --help if firewalld is\n")
|
|
(insert "available on your system.\n")
|
|
(goto-char (point-min))
|
|
(read-only-mode 1)
|
|
(split-window-below)
|
|
(other-window 1)
|
|
(ansi-term "/bin/bash")))
|
|
|
|
(provide 'linuxplus-lesson-120)
|
|
|
|
;;; linuxplus-lesson-120.el ends here
|