https://github.com/osquery/osquery logo
Title
a

allister

05/11/2022, 4:03 AM
can I confirm there's no osquery table for ufw on ubuntu or augeas lens that parses the .rules?
😮 1
I'm dumb, iptables returns ufw-configured results. This is like how the chrome_extensions table can return values for multiple browsers, I should probably send a docs PR
s

seph

05/12/2022, 8:37 PM
I’m not sure this is a docs change.
On linux,
iptables
is a common networking tool. It was the defacto firewall. There are many third party tools that will create/manage/etc iptables rules.
ufw
is a common one. But I’m loathe to try to enumerate them, or even mention them. It feels very different than
chrome_extensions
and chromium browsers. I’d partly expect a site admin to know this. Like, if someone was using puppet to manage their iptable rules, would you expect the osquery docs to talk about puppet there?
And relatedly, there’s a pending issue where linux is moving away from iptables to nettables, and osquery doesn’t support that yet. (Not totally sure I remembered the name)
a

allister

05/13/2022, 12:11 AM
we switched from the iptables puppet module to one called ufw for ubuntu, maybe it's intuitive for people who sysadmin servers, which I am decidedly… not 😅
s

seph

05/13/2022, 7:20 PM
I think it’s an uneasy balance. I don’t really expect you to know all the linux firewall tools, and which of them use what for implementations. But, likewise, I don’t think it’s reasonable for osquery to understand or document all the possible third party tools built on them.