Fedora 7

[Chris Lumens]

> #2 - Improving the system-config-securitylevel. This I need to split in
> two:

I maintain s-c-securitylevel, so I'll address this.

> #2.1 - The current way of setting up firewall rules is excessively
> simple, and makes it very difficult to have simple things like internet
> connection sharing for a home network. It would be very cool to have the
> ability to configure a simple 1:N NAT and some port redirection.

These sorts of features would be handy, I agree.  If they can be simple
one checkbox sorts of things, that's even better.  Getting into the port
redirection stuff takes s-c-securitylevel down a path I don't think we
want to go, though.  It's my understanding that it's never been
developed as the be-all firewall configuration tool that does everything
you'd want to do.  I certainly have not maintained it as such.

A checkbox for enabling NAT would be decent, but I don't know how much
farther beyond that I want to go.

> #2.2 - The local firewall has no logging feature. It's quite difficult
> for a user/home admin to know why something is not working if you don't
> have any kind of logs about what is being dropped because of the
> firewall blocking. Probably having logging enabled by default could be
> just overkill (most end-users won't care about it), but having a way to
> enable/configure logging would help those people a lot.

I have an open bug about this (151647 - it's fairly old at this point)
but have never gotten around to working on it since I didn't see it as a
huge feature.  Of course, I can go in and add it if there's that much
demand.  I can see it being useful for debugging firewalls.

The trick with both of these features is to add them without making the
UI a nightmare to use and maintain.  Maybe I should spend a while
thinking about how to do it.

Two things I want to do in s-c-securitylevel (and if I ever get done
reworking pykickstart, I'll get these in for 7) are:

(1) Rewrite lokkit in Python.  I can hack C but I'm slower at it and I
don't see it as particularly well suited to this sort of program,
especially with the goofy newt stuff.

(2) Make s-c-securitylevel not destroy any customizations you make by
hand.  I think this is the biggest problem affecting the program right
now and if I can come up with a good way to deal with it, I'll put the
fix in right away.  There's an open bug for this - 138143.

- Chris