problem running ufw-init

[stlsaint]

Not sure if this is an issue with the chroot trying to use init but here is the issue.
Trying to configure ufw to use dansguardian and privoxy as a web content filter making ufw push all traffic through dansguardian. This works flawlessly with ubuntu 12.04 64Bit but when i try with 32bit i get error when running: ufw-enable. I dont add any rules or anything, i just extract the ubuntu iso and chroot into it.

ERROR: Problem running ufw-init

I have searched for a couple days now with no results. Last bug posted in regards to this was: https://bugs.launchpad.net/ufw/+bug/920022 which i dont think i have that kernel issue as i have downloaded many images now.

Guidelines:

1. ufw --version
ufw 0.31.1-1

2. Have tried on ubuntu chroot with host of: ubuntu, debian and lubuntu

3. running ufw-enable outputs:
ERROR: Problem running ufw-init

[Jamie Strandboge (jdstrand)]

It sounds like you edited /etc/ufw/before*.rules and got the formatting wrong. You can adjust /etc/ufw/ufw.conf to have 'ENABLED=yes', then run:
$ sudo /lib/ufw/ufw-init flush-all
$ sudo /lib/ufw/ufw-init start

and that may provide more insight. You could also attach your /etc/ufw/*rules to this bug.

[stlsaint (stlsaint)]

I will try your steps from a fresh chroot as they worked from my previous chroot and i want to verify. Also i found a strange workaround hack for them also. If on the host you run iptables -F and then ufw enable on chroot it will start by complain about logging but the firewall will still be in active status. Thank you for your input i will try your steps from afresh.

[stlsaint (stlsaint)]

Here is my before.rules which is the only file i edited. I added everything at the end after the first 'commit' line but i wasnt sure if i was suppose to remove that first commit line and move my rules above it and only have one commit entry at end so i left both in. Could this be the issue.

[Jamie Strandboge (jdstrand)]

These look fine in general, but will fail if the 'dansguardian' or 'privoxy' user doesn't exist on the host. Eg, after editing /etc/ufw/ufw.conf to have 'ENABLED=yes':
$ sudo /lib/ufw/ufw-init stop
$ sudo /lib/ufw/ufw-init start
iptables-restore v1.4.12: owner: Bad value for "--uid-owner" option: "dansguardian"
Error occurred at line: 78
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

Problem running '/etc/ufw/before.rules'

Or after adding the dansguardian user manually:
$ sudo /lib/ufw/ufw-init stop
$ sudo /lib/ufw/ufw-init start
iptables-restore v1.4.12: owner: Bad value for "--uid-owner" option: "privoxy"
Error occurred at line: 79
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

Problem running '/etc/ufw/before.rules'

[stlsaint (stlsaint)]

I have never seen those errors before and i do not have dg or privoxy installed on my host but it is installed within the chroot.

[Jamie Strandboge (jdstrand)]

You won't see those errors just running 'ufw enable' or 'ufw reload'. You will only see them when running /lib/ufw/ufw-init as I showed above. If you do not have dansguardian or privoxy users in /etc/passwd on the host running ufw, then this will fail because iptables-restore cannot map the --uid-owner to a numeric uid. Once you add the entries to your host (using the same numeric uid found in the chroot), this should work. It is probably sufficient to simply use the numeric uid in ufw as found in the chroot, and that way you do not have to add users to the host.

[Jamie Strandboge (jdstrand)]

As this appears to be a local configuration issue, I am going to mark this as Invalid for now. Please feel free to re-open if this is in error.