Debian Bug report logs - #773392
shoreall won't start on systemd-enabled systems

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Bas Zoetekouw <bas@debian.org>

To: submit@bugs.debian.org

Subject: shoreall won't start on systemd-enabled systems

Date: Wed, 17 Dec 2014 22:50:27 +0100

Package: shorewall
Version: 4.6.4.3-1
Severity: important

When first installing shorewall, the init script is not executed in
postinst.  This causes the systemd hooks nt to be run, and the shorewall
systemd config not to be loaded.
When you then enable shorewall in /etc/defualt/shorewall and try to
start it, you get erros like:

bas@debian:/etc/init.d$ sudo /etc/init.d/shorewall start
[....] Starting shorewall (via systemctl): shorewall.serviceFailed to
start shorewall.service: Unit shorewall.service failed to load: No such
file or directory.
 failed!

and

bas@debian:/etc/init.d$ systemctl status shorewall.service
● shorewall.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)


Only after "systemctl daemon reload", the init script will successfully run.


-- System Information:
Debian Release: 8.0
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 3.16.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages shorewall depends on:
ii  bc                     1.06.95-9
ii  debconf [debconf-2.0]  1.5.55
ii  iproute                1:3.16.0-2
ii  iproute2               3.16.0-2
ii  iptables               1.4.21-2+b1
ii  perl-modules           5.20.1-3
ii  shorewall-core         4.6.4.3-1

shorewall recommends no packages.

Versions of packages shorewall suggests:
ii  make           4.0-8
pn  shorewall-doc  <none>

-- Configuration Files:
/etc/shorewall/conntrack [Errno 13] Permission denied:
u'/etc/shorewall/conntrack'
/etc/shorewall/params [Errno 13] Permission denied: u'/etc/shorewall/params'
/etc/shorewall/shorewall.conf changed [not included]

-- debconf information:
  shorewall/invalid_config:
  shorewall/major_release:
  shorewall/dont_restart:

Message #10 received at 773392@bugs.debian.org (full text, mbox, reply):

From: "Andreas B. Mundt" <andi.mundt@web.de>

To: Debian Bug Tracking System <773392@bugs.debian.org>

Subject: shorewall: confirmed

Date: Thu, 18 Dec 2014 19:28:16 +0100

Package: shorewall
Version: 4.6.4.3-1
Followup-For: Bug #773392

Hi,

I run shorewall since some time already, but yesterday I realized the
same problem here.  After boot, there is no shorewall running:

    $ sudo shorewall status
    Shorewall-4.6.4.3 Status at flashgordon - Thu Dec 18 19:11:56 CET 2014

    Shorewall is stopped
    State:Started (Wed Dec 17 22:18:46 CET 2014) from /etc/shorewall/ (/var/lib/shorewall/firewall compiled by Shorewall version 4.6.4.3)

    $ journalctl _SYSTEMD_UNIT=shorewall.service
    -- Logs begin at Thu 2014-12-18 19:08:25 CET, end at Thu 2014-12-18 19:11:56 CET. --

    $ systemctl status shorewall
    ● shorewall.service - LSB: Configure the firewall at boot time
       Loaded: loaded (/etc/init.d/shorewall)
          Active: inactive (dead)

Starting shorewall manually works fine:

    $ systemctl start shorewall

    $ systemctl status shorewall
    ● shorewall.service - LSB: Configure the firewall at boot time
       Loaded: loaded (/etc/init.d/shorewall)
          Active: active (exited) since Thu 2014-12-18 19:15:32 CET; 2s ago
            Process: 2186 ExecStart=/etc/init.d/shorewall start (code=exited, status=0/SUCCESS)

    Dec 18 19:15:32 flashgordon shorewall[2186]: Starting "Shorewall firewall": done.
    Dec 18 19:15:32 flashgordon systemd[1]: Started LSB: Configure the firewall at boot time.

I am tempted to increase the severity, as a non-starting firewall may
have severe implications on the security of the system and this should
be fixed for jessie.

Best regards,

     Andi


-- System Information:
Debian Release: 8.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages shorewall depends on:
ii  bc                     1.06.95-9
ii  debconf [debconf-2.0]  1.5.54
ii  iproute                1:3.16.0-2
ii  iproute2               3.16.0-2
ii  iptables               1.4.21-2+b1
ii  perl-modules           5.20.1-3
ii  shorewall-core         4.6.4.3-1

shorewall recommends no packages.

Versions of packages shorewall suggests:
ii  make           4.0-8
pn  shorewall-doc  <none>

Message #15 received at 773392@bugs.debian.org (full text, mbox, reply):

From: "Andreas B. Mundt" <andi.mundt@web.de>

To: Debian Bug Tracking System <773392@bugs.debian.org>

Subject: shorewall: broken ordering cycle

Date: Thu, 01 Jan 2015 13:12:49 +0100

Package: shorewall
Version: 4.6.4.3-1
Followup-For: Bug #773392

Dear Maintainer,

some more information:  It looks like systemd is not able to order the
dependencies propperly.  From yournalctl:

[...]
Jan 01 09:45:35 flashgordon systemd[1]: Found ordering cycle on basic.target/start
Jan 01 09:45:35 flashgordon systemd[1]: Found dependency on sysinit.target/start
Jan 01 09:45:35 flashgordon systemd[1]: Found dependency on shorewall.service/start
Jan 01 09:45:35 flashgordon systemd[1]: Found dependency on network-online.target/start
Jan 01 09:45:35 flashgordon systemd[1]: Found dependency on network.target/start
Jan 01 09:45:35 flashgordon systemd[1]: Found dependency on systemd-networkd.service/start
Jan 01 09:45:35 flashgordon systemd[1]: Found dependency on dbus.service/start
Jan 01 09:45:35 flashgordon systemd[1]: Found dependency on basic.target/start
Jan 01 09:45:35 flashgordon systemd[1]: Breaking ordering cycle by deleting job shorewall.service/start
Jan 01 09:45:35 flashgordon systemd[1]: Job shorewall.service/start deleted to break ordering cycle starting with basic.target/start
[...]

This might be the reason shorewall fails to start.  On another machine it seems
to work fine, no idea what's different there.

Regards,

    Andi

Message #22 received at 773392@bugs.debian.org (full text, mbox, reply):

From: "Andreas B. Mundt" <andi@debian.org>

To: 773392@bugs.debian.org

Subject: suggested solution

Date: Sun, 15 Feb 2015 18:50:50 +0100

Hi,

with help from Alam_Squeeze on irc #debian-systemd we found a way to fix
this issue:

The init script /etc/init.d/shorewall had to be modified like

-# Default-Start:     S
+# Default-Start:     2 3 4 5

and then I ran:

 update-rc.d shorewall remove
 update-rc.d shorewall defaults

After that, shorewall was started properly after boot and the
dependency circle was gone.

Best regards,

    Andi

Message #27 received at 773392@bugs.debian.org (full text, mbox, reply):

From: Alexandre Hoïde <alexandre.hoide@gmail.com>

To: Debian Bug Tracking System <773392@bugs.debian.org>

Subject: Re: shoreall won't start on systemd-enabled systems

Date: Wed, 14 Oct 2015 22:48:09 +0200

Package: shorewall
Version: 4.6.4.3-2
Followup-For: Bug #773392

Dear Maintainer,

Same as OP. Applied Andy's solution which fixed the problem.

Best regards,
Alexandre Hoïde

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.2.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=fr_CH.UTF-8, LC_CTYPE=fr_CH.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages shorewall depends on:
ii  bc                     1.06.95-9
ii  debconf [debconf-2.0]  1.5.57
ii  iproute                1:4.1.1-1
ii  iproute2               4.1.1-1
ii  iptables               1.4.21-2+b1
ii  perl                   5.20.2-6
ii  shorewall-core         4.6.4.3-2

shorewall recommends no packages.

Versions of packages shorewall suggests:
ii  make           4.0-8.2
ii  shorewall-doc  4.6.4-1

-- Configuration Files:
/etc/default/shorewall changed:
startup=1
OPTIONS=""
STARTOPTIONS=""
RESTARTOPTIONS=""
INITLOG=/dev/null
SAFESTOP=1

/etc/init.d/shorewall changed:
.. /lib/lsb/init-functions
SRWL=/sbin/shorewall
SRWL_OPTS="-tvv"
WAIT_FOR_IFUP=/usr/share/shorewall/wait4ifup
test -n ${INITLOG:=/var/log/shorewall-init.log}
test -x $SRWL || exit 0
test -x $WAIT_FOR_IFUP || exit 0
test -n "$INITLOG" || {
	echo "INITLOG cannot be empty, please configure $0" ;
	exit 1;
}
if [ "$(id -u)" != "0" ]
then
  echo "You must be root to start, stop or restart \"Shorewall firewall\"."
  exit 1
fi
echo_notdone () {
  if [ "$INITLOG" = "/dev/null" ] ; then
	  echo "not done."
  else
	  echo "not done (check $INITLOG)."
  fi
  exit 1
}
not_configured () {
	echo "#### WARNING ####"
	echo "The firewall won't be started/stopped unless it is configured"
	if [ "$1" != "stop" ]
	then
		echo ""
		echo "Please read about Debian specific customization in"
		echo "/usr/share/doc/shorewall/README.Debian.gz."
	fi
	echo "#################"
	exit 0
}
.. /usr/share/shorewall/shorewallrc
if [ -f "${SYSCONFDIR}/shorewall" ]
then
	. ${SYSCONFDIR}/shorewall
	SRWL_OPTS="$SRWL_OPTS $OPTIONS"
	if [ "$startup" != "1" ]
	then
		not_configured
	fi
else
	not_configured
fi
[ "$INITLOG" = "/dev/null" ] && SHOREWALL_INIT_SCRIPT=1 || SHOREWALL_INIT_SCRIPT=0
export SHOREWALL_INIT_SCRIPT
wait_for_pppd () {
	if [ "$wait_interface" != "" ]
	then
		for i in $wait_interface
		do
			$WAIT_FOR_IFUP $i 90
		done
	fi
}
shorewall_start () {
  echo -n "Starting \"Shorewall firewall\": "
  wait_for_pppd
  $SRWL $SRWL_OPTS start $STARTOPTIONS >> $INITLOG 2>&1 && echo "done." || echo_notdone
  return 0
}
shorewall_stop () {
  echo -n "Stopping \"Shorewall firewall\": "
  if [ "$SAFESTOP" = 1 ]; then
      $SRWL $SRWL_OPTS stop >> $INITLOG 2>&1 && echo "done." || echo_notdone
  else
      $SRWL $SRWL_OPTS clear >> $INITLOG 2>&1 && echo "done." || echo_notdone
  fi
  return 0
}
shorewall_restart () {
  echo -n "Restarting \"Shorewall firewall\": "
  $SRWL $SRWL_OPTS restart $RESTARTOPTIONS >> $INITLOG 2>&1 && echo "done." || echo_notdone
  return 0
}
shorewall_refresh () {
  echo -n "Refreshing \"Shorewall firewall\": "
  $SRWL $SRWL_OPTS refresh >> $INITLOG 2>&1 && echo "done." || echo_notdone
  return 0
}
shorewall_status () {
  $SRWL $SRWL_OPTS status && exit 0 || exit $?
}
case "$1" in
  start)
     shorewall_start
     ;;
  stop)
     shorewall_stop
     ;;
  refresh)
     shorewall_refresh
     ;;
  force-reload|restart)
     shorewall_restart
     ;;
  status)
     shorewall_status
     ;;
  *)
     echo "Usage: /etc/init.d/shorewall {start|stop|refresh|restart|force-reload|status}"
     exit 1
esac
exit 0

/etc/shorewall/conntrack [Errno 13] Permission non accordée: u'/etc/shorewall/conntrack'
/etc/shorewall/params [Errno 13] Permission non accordée: u'/etc/shorewall/params'
/etc/shorewall/shorewall.conf changed:
STARTUP_ENABLED=Yes
VERBOSITY=1
BLACKLIST_LOG_LEVEL=
INVALID_LOG_LEVEL=
LOG_BACKEND=
LOG_MARTIANS=Yes
LOG_VERBOSITY=2
LOGALLNEW=
LOGFILE=/var/log/messages
LOGFORMAT="Shorewall:%s:%s:"
LOGTAGONLY=No
LOGLIMIT=
MACLIST_LOG_LEVEL=info
RELATED_LOG_LEVEL=
RPFILTER_LOG_LEVEL=info
SFILTER_LOG_LEVEL=info
SMURF_LOG_LEVEL=info
STARTUP_LOG=/var/log/shorewall-init.log
TCP_FLAGS_LOG_LEVEL=info
UNTRACKED_LOG_LEVEL=
ARPTABLES=
CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
GEOIPDIR=/usr/share/xt_geoip/LE
IPTABLES=
IP=
IPSET=
LOCKFILE=
MODULESDIR=
NFACCT=
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
PERL=/usr/bin/perl
RESTOREFILE=restore
SHOREWALL_SHELL=/bin/sh
SUBSYSLOCK=
TC=
ACCEPT_DEFAULT=none
DROP_DEFAULT=Drop
NFQUEUE_DEFAULT=none
QUEUE_DEFAULT=none
REJECT_DEFAULT=Reject
RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
RSH_COMMAND='ssh ${root}@${system} ${command}'
ACCOUNTING=Yes
ACCOUNTING_TABLE=filter
ADD_IP_ALIASES=No
ADD_SNAT_ALIASES=No
ADMINISABSENTMINDED=Yes
BASIC_FILTERS=No
IGNOREUNKNOWNVARIABLES=No
AUTOCOMMENT=Yes
AUTOHELPERS=Yes
AUTOMAKE=No
BLACKLIST="NEW,INVALID,UNTRACKED"
CHAIN_SCRIPTS=Yes
CLAMPMSS=No
CLEAR_TC=Yes
COMPLETE=No
DEFER_DNS_RESOLUTION=Yes
DELETE_THEN_ADD=Yes
DETECT_DNAT_IPADDRS=No
DISABLE_IPV6=No
DONT_LOAD=
DYNAMIC_BLACKLIST=Yes
EXPAND_POLICIES=Yes
EXPORTMODULES=Yes
FASTACCEPT=No
FORWARD_CLEAR_MARK=
HELPERS=
IMPLICIT_CONTINUE=No
INLINE_MATCHES=Yes
IPSET_WARNINGS=Yes
IP_FORWARDING=Keep
KEEP_RT_TABLES=No
LEGACY_FASTSTART=Yes
LOAD_HELPERS_ONLY=Yes
MACLIST_TABLE=filter
MACLIST_TTL=
MANGLE_ENABLED=Yes
MAPOLDACTIONS=No
MARK_IN_FORWARD_CHAIN=No
MODULE_SUFFIX=ko
MULTICAST=No
MUTEX_TIMEOUT=60
NULL_ROUTE_RFC1918=No
OPTIMIZE=0
OPTIMIZE_ACCOUNTING=No
REJECT_ACTION=
REQUIRE_INTERFACE=No
RESTORE_DEFAULT_ROUTE=Yes
RESTORE_ROUTEMARKS=Yes
RETAIN_ALIASES=No
ROUTE_FILTER=Yes
SAVE_ARPTABLES=No
SAVE_IPSETS=No
TC_ENABLED=Internal
TC_EXPERT=No
TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
TRACK_PROVIDERS=No
TRACK_RULES=No
USE_DEFAULT_RT=Yes
USE_PHYSICAL_NAMES=No
USE_RT_NAMES=No
WARNOLDCAPVERSION=Yes
ZONE2ZONE=-
BLACKLIST_DISPOSITION=DROP
INVALID_DISPOSITION=CONTINUE
MACLIST_DISPOSITION=REJECT
RELATED_DISPOSITION=ACCEPT
RPFILTER_DISPOSITION=DROP
SMURF_DISPOSITION=DROP
SFILTER_DISPOSITION=DROP
TCP_FLAGS_DISPOSITION=DROP
UNTRACKED_DISPOSITION=CONTINUE
TC_BITS=
PROVIDER_BITS=
PROVIDER_OFFSET=
MASK_BITS=
ZONE_BITS=0
IPSECFILE=zones


-- debconf information:
  shorewall/dont_restart:
  shorewall/invalid_config:
  shorewall/major_release:

Message #34 received at 773392-close@bugs.debian.org (full text, mbox, reply):

From: roberto@connexer.com (Roberto C. Sanchez)

To: 773392-close@bugs.debian.org

Subject: Bug#773392: fixed in shorewall 5.0.3.1-1

Date: Sun, 10 Jan 2016 21:40:25 +0000

Source: shorewall
Source-Version: 5.0.3.1-1

We believe that the bug you reported is fixed in the latest version of
shorewall, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 773392@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Roberto C. Sanchez <roberto@connexer.com> (supplier of updated shorewall package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 10 Jan 2016 14:57:16 -0500
Source: shorewall
Binary: shorewall
Architecture: source all
Version: 5.0.3.1-1
Distribution: unstable
Urgency: low
Maintainer: Roberto C. Sanchez <roberto@connexer.com>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 shorewall  - Shoreline Firewall, netfilter configurator
Closes: 729256 773392 776680 796695
Changes:
 shorewall (5.0.3.1-1) unstable; urgency=low
 .
   * New Upstream Version (Closes: #729256, #773392, #776680, #796695)
Checksums-Sha1:
 bcd02e406bfadcdbb4d254e02b9f687e118d4fe4 1860 shorewall_5.0.3.1-1.dsc
 380483e5b1d29d5144153fa0f9cafdd0fd24456a 751626 shorewall_5.0.3.1.orig.tar.gz
 d968ebcaa3d47d3cc9ada348ab9f084cec7d4348 34308 shorewall_5.0.3.1-1.debian.tar.xz
 0b703be9ab0397511efc09bd261816e3d7fb9f29 677102 shorewall_5.0.3.1-1_all.deb
Checksums-Sha256:
 01ab3096801c19276233245864e730cda8d02954e4dce9d14bea996019ffa73f 1860 shorewall_5.0.3.1-1.dsc
 02df45a1a5afb72e06bcf9250d9de3ed9d73fe39d060ad83f4cd7169d4cae200 751626 shorewall_5.0.3.1.orig.tar.gz
 a2fa1cc0c1e8ffecf7552ce715c4ab28af05624b9ffc8b502bb0d687bc8ecc96 34308 shorewall_5.0.3.1-1.debian.tar.xz
 c5576c42af273bde675fe3756789ada54922a989698db7bb9fdbd9a0c1b32f3b 677102 shorewall_5.0.3.1-1_all.deb
Files:
 153f7b93d55195ad8420df03c8d83d86 1860 net optional shorewall_5.0.3.1-1.dsc
 f2eae4aff9f684a7966c780ee333ca5b 751626 net optional shorewall_5.0.3.1.orig.tar.gz
 85879ed69ed820a15df75c51220ca5f7 34308 net optional shorewall_5.0.3.1-1.debian.tar.xz
 991f8ac3734e6afc31a76d4370365dc9 677102 net optional shorewall_5.0.3.1-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWks0jAAoJECzXeF7dp7IPr5EP/05p/uK0T/3x+0HyNQ8Wi1UX
pRLck5Kx29yhnPogatpMIWc/2TKdjRT2XPoTmZUYU6xy1J6RZ1C44o/o/xZDLAYR
OsJoK6B0+ULVnFWzYPVH/obZ12m6yG6Xi6IY+rKvtVx16EMU8oRKDITwIH0yAkaC
xGDkM5+BaVZ+miZSFjnI5kU830ttt0onwMgcnrPVioPhkI7L7T7aMyl/oEg01kIO
5tvpApQOcR2CgTX70Bc5MWBBGJBmcWm7IRd5bcKV/aTzjphGMvuJbV7WkHULHsqi
LYaohFb9bpKX8c/Wh+SzdXdS+NQeA++3t1BpC4m06Ama6a0cdoD6BU/nhRn5ZhWA
JR+SqZtj0ktDGHcLFu6VecIk+pY2MCN2vU1uxzjGBPGIkOVUeOzqfXOo3C1VNMBL
YXUO8IKt4C1EVdEX1pY9JmIeIvYE2WvGgIM+cTlSX6W4SpbD1g6pcjx5nD+6pS3J
ejUOXvG8jwOj0AwH+AtqLDENSP3cEKu7YeuHESjc9zMWtjvnpG0dyjDh720UM5Si
SQaKragyK3FRg02Ruyhpi5aVuRDxEsqMqM5GCBK/ZZbupIzp46WQEPXdzCSu0IH/
9KKyFVe+JijS/po4exeIkPB/a1bpKBLEYnYslGooUqQWlmdf92zXEVrsESb4Nybk
IOqlSNOqccDGjn55Mx86
=9BB2
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.