Over recent weeks i keep thinking i have autostarted UFW, only to find each time later that i remember to check it, that nope, it’s not running.
Today’s latest attempt is typical.
After first checking the status with both run0 ufw status and systemctl status ufw, and then graphically in System Settings, and seeing all indicated it was not running [ergo my prior attempt last week had not persisted across the subsequent reboot with last weeks update], i then Started it in the latter.
I confirmed it was apparently then running via run0 ufw status
Next, hoping to make it permanent, i ran run0 systemctl enable ufw
I performed today’s weekly kdelinux update & reboot
Upon logging in, i checked run0 ufw status and systemctl status ufw, and sadly both indicated UFW was again disabled
I ran run0 systemctl enable --now ufw, but stillrun0 ufw status said it was Status: inactive
I then Enabled it graphically in System Settings, but given my history with it, atm i have little confidence that i have solved it
In this case, the file /etc/ufw/ufw.conf (which is changed when you enable the firewall in System Settings) will be overwritten to the default version which contains ENABLED=no.
Oh dear, those symptoms as described in that b/r certainly do seem consistent with the behaviour that’s been perplexing me. So, presumably, i need to stop fighting it, & instead wait for the upstream fix in a future build?
Yes, that’s probably best. If you really wanted to work around, you could back up the config files and re-copy them on each upgrade, but that’s pretty annoying of course!
I gave up trying to create a keyboard shortcut and reverted to an old habit. I always make a new Folder for whatever distro I’m using to keep various ‘Fixes’ in.
Then if I have config changes to modify and copy to root somewhere (especially if I have to do them often) I add a Sub-Folder for each and the config file inside.
In bash I simply edit bashrc and add a shortcut. In zsh, it isn’t so easy.
So I installed Sticky Notes from flathub.
Then I did:
sudo ufw enable
and checked /etc/ufw/udw.conf to make sure it was set to ENABLED=yes
Next I copied ufw.conf into my Fixes folder in /Home.
Then I wrote out the script to copy ufw.conf from my Fixes folder to /etc/ufw and overwrite ufw.conf
For mysystem itlooks like:
sudo cp -f ~/0-Fixes-KDE-Linux/Config-Files-to-copy-after-software-updates/ufw/ufw.conf /etc/ufw/ufw.conf
I saved it in a text file in my Fixes folkder, and also in a Sticky Note on my Desktops.
Set ufw to Disabled
Ran the command in Konsole and checked /etc/ufw/ufw/conf and it is back to ENABLED=yes
So after an Update that stops ufw running at boot I can simply copy the command from the sticky note and run it and ufw will be enabled on boot until the next system update.
****
NOTE
Sorry for the long-winded description, but I try to assume new users will read stuff I post, so I try to be as ‘step by step’ as possible . .
I forgot to say I also tried to run sudo ufw enable in Autostart, and I created a bash script to run it and that failed too. Probably my error. So I decided to just do it as a copy - paste command to run once after a System update.
Thanks. Whilst admittedly i had not thought out the explicit steps needed, i had pondered trying to automate it via a bash script as a workaround… but then i just decided i’d be lazy. So instead all i’ve sone is placed a transparent sticky note on my desktop, with bolded text saying “Start Firewall !!”. My eyes will fall upon this sight each time i login after reboots, so it’ll do the job, inelegant & lazy as it is… but i do hope the root cause gets fixed soon.
That works fine, and it is how I was doing it. I just got sick of doing it first boot every day after a big update.
So I decided to try it with the copy command.
Now I only have to do it the first day after an update that kills it. Until the next one.
Fingers crossed they fix it soon. Except for that and the time trying to install KDE-Linux into my root partition and keep my old /home partition killed all my saved files, I’ve been enjoying this immutable idea.
Ok, this may not work for everyone, but it just made life easier for me.
I discovered I can be in Konsole and type:
bash
then hit Enter, and I have swapped from zsh to bash.
One of the things I have in KDE-neon is a file called .inputrc (a dot in front of the name) in my home folder, and inside .inputrc I have a heap of commands I can run with a key combination.
I changed a line so it reads:
Control-l: “sudo cp -f ~/0-Fixes-KDE-Linux/Config-Files-to-copy-after-software-updates/ufw/ufw.conf /etc/ufw/ufw.conf”
~/0-Fixes-KDE-Linux is the directory where I keep things to make odd bits of KDE-Linux ‘work’ when they are annoying me.
/Config-Files-to-copy-after-software-updates/ is self explanatory. I also have a fix for CUPS when it loses my printers after an update, stuff like that.
and /ufw/ufw.conf /etc/ufw/ufw.conf is the directory with the file I am copying and the destination.
Now to fix this problem, instead of copying the command from a Sticky Note, I can open a terminal and do the following:
bash [Enter]
Ctrl L [Enter] (don;t use shift, I’m just showing L as it looks on my keyboard because some people think its an ‘I’ in the line)
Password [Enter]
zsh [Enter]
So I’ve swapped my Terminal from zsh to bash, then run Ctrl L and that copies the ufw.conf file and overwrites it so UFW runs at boot from now until the next update.
Then I’ve swapped my shell back to zsh.
A bonus for me though is that I have a heap of other keyboard shortcuts in inputrc, anfd now I can use some of them
I don’t know if everyone can do the swap to bash and back thing. I don;t recall installing bash, so there’s a chance it may be there . .
One subtle distinction here: `systemctl enable --now ufw` starts/enables the unit, but UFW itself will still report “inactive” when `/etc/ufw/ufw.conf` contains `ENABLED=no`. I would run `run0 ufw enable`, then verify with `run0 ufw status verbose` and `run0 grep ‘^ENABLED’ /etc/ufw/ufw.conf` (it should say `ENABLED=yes`). Given the `/etc` overwrite issue mentioned above, I’d recheck that file after each system update; the service enable alone won’t restore a setting that was reset. If this is a remote machine, keep an existing session open while testing so you don’t lock yourself out.
OK, thank you… but i hope that’s still only a short-term workaround, with a proper permanent solution in the pipeline so it only has to be enabled & started once, impervious to subsequent updates & reboots, unlike now.
I just tested it again after this morning’s Update.checked /etc/ufw/ufw.conf and the file said ENABLED=no
Did the Ctrl L thing and checked and /etc/ufw/ufw.conf now says ENABLED=yes
Went to Menu and looked for Firewall. It shows ENABLED also.
So there’s a possibility it may work for some people - but not for others Still, for those where it does work it is a simple work-around.
Also KDElinux systems probably don’t have .inputrc
it is a plain Text File with a dot in front to make it Hidden
It only needs to have the line:
Control-l: “sudo cp -f ~/[path to where you keep the copy of ufw.conf with ENABLED=yes]/ufw/ufw.conf /etc/ufw/ufw.conf”
Unless (as I do) you use it to make a host of keyboard Shortcuts.
Just have to remember Type bash in Konsole first , then remember to type zsh again in Konsole OR open a New Terminal before you do other stuff . .
That makes sense, and it is useful to know the setting can be reset by an update on some systems. I would treat the copied ufw.conf as a small recovery step rather than relying on the GUI state alone. After an update, checking both systemctl is-enabled ufw and the ENABLED value is a quick way to catch it before the next reboot. The note about starting bash before using the shortcut is helpful too, especially if Konsole opens the user’s default shell as zsh.
One of the things that always fascinated me about the whole KDE project is that when users (including geriatrics like me) ask about something, not ‘ask for’ something’, just ‘about’, there’s usually someone working on it already.
This morning there was a 3.8GB Update and after it installed:
ufw was ‘Enabled’.
CUPS was ‘Enabled’.
I didn’t have to mess around in the Terminal. All I had to do was log into CUPS and install my printers again.
Likewise when Plasma 6 was in Beta. I wanted to install neon on a Surface Pro tablet.
other Desktops had Auto Screen Rotate Enabled for Portrait/Landscape, but not KDE.
I queried it, and suggested a stop-gap solution. I don;t think the team used that solution, but by the time the next beta was out (about a week) the Screen Rotate was fixed.
That’s what made KDE a dream to work with testing various distros about 20 years ago.
This KDE Linux is turning out to be an extension of that same Team Spirit.
I commented in the thread about the name KDE Linux that until a few little glitches were sorted out it was still a bit of a toy. Fun to play with, but not ready yet.
Didn’t things change fast?
I’m still working out just how to break it. I know nothing is idiot proof, so I’m sure this one can find something . .
In the mean time I would feel comfortable giving this distribution to a beginner if I was still working.
Thanks for the kind words! KDE Linux is indeed being developed exactly for the reasons and purposes you mention.
That said, while CUPS is intended to be enabled by default, ufw is not. So that one should have stayed disabled — unless you had attempted to manually enable it in the past! If you had, then everything is working as expected. If not, I think you may also be experiencing a different bug of some kind.
Thanks Nate, I’ll check again after the next decent sized updates and see if ufw is running after the Update. After all my past sizeable Updates, ufw has had to be turned ON by going into Firewall via the Menu. Which is why I did the copy ufw.conf thing.
Today’s Update (it may have been yesterday’s - I was away for the day) at 3.8GB should have been big enough to kill ufw based on past experiences, but maybe not.
That still doesn’t explain cups being enabled for the first time (for me at any rate) and I’ll be interested to see what the next sizeable Update brings.
In the meantime, I think it is time to start looking for the Donations page again. Is that a KDE across the board thing, or is there a specific donations page for the distribution as well?
being an aged pensioner I like to direct the limited donations I can make to specific areas. If I can afford to this season I would like to slide 100 to neon, and also to KDE and KDE Linux.
I know it doesn’t go far, but hey, its better than having to subscribe to software licences from Mic, umm, other OSes . .
Donate and support KDE - KDE Community is what you’re looking for. It’s an across-the-board thing, yeah; most projects don’t have their own project-specific funding channels. A few do, but this is a primordial thing in KDE.
The challenge is that project-specific funding doesn’t really amount to anything until it crosses the magical threshold of “enough money to pay a passion-driven FOSS developer at least a modest living wage.” So, probably €40k a year, at the very minimum. Even that amount is pretty paltry in most countries. But building a consistent income stream of €40k/yr is no mean feat!
That’s why in general all the donations go to KDE e.V. itself. It can then pay specific people out of a much larger pot.
That said, KDE Linux has no such people who are paid in this way. The project’s principal developers are all passionate volunteers with their own FOSS or FOSS-adjacent jobs. But the project is also supported by KDE e.V. in other ways.
Anyway, if you do decide to donate, every little bit helps, and it’s all greatly appreciated!
Thanks Nate,
I made it Euros instead of AUD because that gives KDE almost an extra $70.
It might pay for a cup of coffee
I still ‘like’ neon a lot, but I am really glad this KDE Linux is working out.
Running neon through KRDC into another machine is almost indistinguishable from running NoMachine’s Commercial offering.
And with today’s update, UFW started up DISABLED again.
However CUPS was Enabled and all I had to do was add printers.
So I wonder why the UFW thing is hit and miss. I know running a Firewall is not essential, but it is a nice thing to know there’s something trying to keep the nasties out sometimes. Especially not that running my VPN is out of the question unless I go the whole way and install it inside my router . .
