inicio/openSUSE Leap 16/Install / Initial Config

Initial Settings : Firewall

rev 2025/10/10

	Configure Firewall and SELinux.
[1]	It's possible to display FireWall Service Status like follows. (enabled by default)

localhost:~ #

systemctl status firewalld

● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)
     Active: active (running) since Fri 2025-10-10 13:50:32 JST; 16min ago
 Invocation: 9df52c37c8ab463b8ecd416407d582fe
       Docs: man:firewalld(1)
   Main PID: 898 (firewalld)
      Tasks: 2 (limit: 4662)
        CPU: 263ms
     CGroup: /system.slice/firewalld.service
.....
.....

# [Active: active (running) ***] means firewalld is running now

[2]	If you use FireWall service, it needs to modify FireWall settings manually because incoming requests for services are mostly not allowed by default. Refer to here for basic Firewall operation and settins. Configuration examples of openSUSE Leap 16 on this site are based on the environment Firewalld service is always enabled.
[3]	If you don't need FireWall service because of some reasons like that some FireWall Machines are running in your Local Netowrk or others, it's possible to stop and disable FireWall service on openSUSE server like follows.

# stop service

localhost:~ #

systemctl stop firewalld

# disable service

localhost:~ #

systemctl disable firewalld

Removed '/etc/systemd/system/multi-user.target.wants/firewalld.service'.
Removed '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'.

Initial Settings : SELinux

[4]	It's possible to display current SELinux (Security-Enhanced Linux) Status like follows. (enabled by default)

localhost:~ #

getenforce

Enforcing     # SELinux is enabled

[5]	If you enable SELinux, there are cases to modify SELinux policies manually because sometimes SELinux stops applications. Refer to here for basic SELinux operation and settins. Configuration examples of openSUSE Leap 16 on this site are based on the environment SELinux is always Enforcing.
[6]	If you don't need SELinux feature because of some reasons like that your server is running only in Local safety Network or others, it's possible to disable SELinux like follows.

localhost:~ #

vi /etc/default/grub

# line 11 : change to [selinux=0]
GRUB_CMDLINE_LINUX_DEFAULT="mitigations=auto quiet security=selinux selinux=0"

# apply changes

localhost:~ #

grub2-mkconfig -o /boot/grub2/grub.cfg

Generating grub configuration file ...
Found theme: /boot/grub2/themes/openSUSE/theme.txt
Found linux image: /boot/vmlinuz-6.12.0-160000.5-default
Found initrd image: /boot/initrd-6.12.0-160000.5-default
Warning: os-prober will be executed to detect other bootable partitions.
Its output will be used to detect bootable binaries on them and create new boot entries.
37.452022 | DM multipath kernel driver not loaded
Adding boot menu entry for UEFI Firmware Settings ...
done

# restart to enable the new setting

localhost:~ #

reboot