Add an rm confirmation guard article and a ufw guide

2026-09-05 12:42:58 +02:00
parent 142788d740
commit 34e4beb0d7
5 changed files with 155 additions and 32 deletions
@@ -198,3 +198,63 @@ Being outside `apt` also means it won't be updated by `apt full-upgrade`. Repeat

 #### Done !
 ::
+
+## ufw, a firewall you can actually read
+
+Debian's firewall (`iptables`/`nftables` under the hood) is powerful and unreadable directly. `ufw`, *uncomplicated firewall*, is a thin layer on top that turns it into short, plain-English rules, block everything by default and open only what you actually expose.
+
+::steps{level="4"}
+#### Install it
+
+```bash [Terminal]
+sudo apt install ufw
+```
+
+#### Set the default policy
+
+```bash [Terminal]
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+```
+
+Nothing gets in unless a rule says so, everything the server itself initiates still goes out normally.
+
+#### Allow what you actually need
+
+```bash [Terminal]
+sudo ufw allow OpenSSH
+sudo ufw allow 443/tcp
+```
+
+`OpenSSH` is a built-in profile that matches the SSH port, no need to remember which one. Add one `allow` per port you expose, [SWAG](/serveex/core/swag) on `443` for instance.
+
+::warning
+Allow SSH **before** enabling the firewall, in the next step. Enable it first and the very connection you're typing in gets cut, with no screen left plugged in to fix it.
+::
+
+#### Enable it
+
+```bash [Terminal]
+sudo ufw enable
+```
+
+#### Check the rules
+
+```bash [Terminal]
+sudo ufw status verbose
+```
+
+```console [Output]
+Status: active
+Logging: on (low)
+Default: deny (incoming), allow (outgoing), disabled (routed)
+
+To                         Action      From
+--                         ------      ----
+22/tcp (OpenSSH)           ALLOW IN    Anywhere
+443/tcp                    ALLOW IN    Anywhere
+```
+
+#### Done !
+::
+