Skip to content
Log In

Remove iptables-services Package

An XCCDF Rule

Description

The iptables-services package can be removed with the following command: 
$ sudo yum erase iptables-services

Rationale

iptables-services provides the services iptables and ip6tables that have been split out of the base package since they are not active by default anymore. These services load the iptables rules during the system startup and also allow one to reload the iptables rules during runtime. Those iptables services conflicts with firewalld so they should be removed if firewalld is used.

ID
xccdf_org.ssgproject.content_rule_package_iptables-services_removed
Severity
Medium
References
Updated

Remediation Templates

Anaconda Pre-Install Instructions

package --remove=iptables-services

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-86678-0
  - disable_strategy

A Puppet Snippet

include remove_iptables-services
class remove_iptables-services {
  package { 'iptables-services':
    ensure => 'purged',
  }
}

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q iptables; then
# CAUTION: This remediation script will remove iptables-services
#	   from the system, and may remove any packages
#	   that depend on iptables-services. Execute this
#	   remediation AFTER testing on a non-production