- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
The iptables-services
package can be removed with the following command:
$ sudo yum erase iptables-services
iptables-services
provides the services iptables and ip6tables that have been split
out of the base package since they are not active by default anymore. These services load the
iptables rules during the system startup and also allow one to reload the iptables rules
during runtime. Those iptables services conflicts with firewalld so they should be removed if
firewalld is used.
The following script can be run on the host to remediate the issue.
#!/bin/bash
# Remediation is applicable only in certain platforms
if rpm --quiet -q iptables; then
# CAUTION: This remediation script will remove iptables-services
# from the system, and may remove any packages
# that depend on iptables-services. Execute this
# remediation AFTER testing on a non-production
# system!
if rpm -q --quiet "iptables-services" ; then
yum remove -y "iptables-services"
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-86678-0
- disable_strategy
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- package_iptables-services_removed
- name: Ensure iptables-services is removed
package:
name: iptables-services
state: absent
when: '"iptables" in ansible_facts.packages'
tags:
- CCE-86678-0
- disable_strategy
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- package_iptables-services_removed