#1104530 installation-reports: firewalld unexpectedly installed by the Debian installer

#1104530#5
Date:
2025-05-01 15:37:23 UTC
From:
To:
(Please provide enough information to help the Debian
maintainers evaluate the report efficiently - e.g., by filling
in the sections below.)

Boot method: netinst image
Image version: Debian testing install image downloaded from the Debian site on
2025-04-21
Date: 2025-05-02

Machine: Homebuilt based on Gigabyte Technology Co., Ltd..B760M D3H DDR4
Processor: 12th Gen Intel(R) Core(TM) i5-12400
Memory: 16 GB
Partitions:
Filesystem     Type     1K-blocks      Used Available Use% Mounted on
udev           devtmpfs   8035216         0   8035216   0% /dev
tmpfs          tmpfs      1614664      2040   1612624   1% /run
/dev/sda2      ext4      22758848   7165880  14411528  34% /
tmpfs          tmpfs      8073312         4   8073308   1% /dev/shm
efivarfs       efivarfs       256       112       140  45%
/sys/firmware/efi/efivars
tmpfs          tmpfs         5120         8      5112   1% /run/lock
tmpfs          tmpfs         1024         0      1024   0%
/run/credentials/systemd-journald.service
tmpfs          tmpfs      8073312       136   8073176   1% /tmp
/dev/sda3      ext4        996780     11928    916040   2% /mnt
/dev/md1p1     ext4     960178900 742651508 168679676  82% /home
/dev/sda1      vfat        523244     12424    510820   3% /boot/efi
tmpfs          tmpfs      1614660      4360   1610300   1% /run/user/1000
tmpfs          tmpfs      1614660        60   1614600   1% /run/user/0

Base System Installation Checklist:
[O] = OK, [E] = Error (please elaborate below), [ ] = didn't try it

Initial boot:           [O]
Detect network card:    [O]
Configure network:      [O]
Detect media:           [O]
Load installer modules: [O]
Clock/timezone setup:   [O]
User/password setup:    [O]
Detect hard drives:     [O]
Partition hard drives:  [O]
Install base system:    [O]
Install tasks:          [O]
Install boot loader:    [O]
Overall install:        [O]

Comments/Problems:

firewalld appears to be part of the base installation for reasons unknown and
is not configured by default with exceptions to allow NFS file shares on the
computer to be accessible.
Two nearly identical systems have been installed in the past week with this
installer. The only difference in the installer settings is the selection of
the web server for installation in the task selection of the second
installation (this one). The installer has not placed firewalld on this
computer whereas it did install firewalld on the first computer. Both systems
were installed in the same basic steps:
1. Perform the installation
2. Set up MDADM software RAID arrays
3. Change the home path to access the existing home drive on a software RAID
partition.
4. Reboot the computer
5. Install nfs-kernel-server
6. Set up NFS file shares
7. Try to connect to NFS file shares from another computer.

The first computer's network shares were inaccessible after completing NFS
server installation and configuration. It was eventually discovered that
firewalld was running preventing RPC access from clients attempting to connect
to NFS shares. This required commands to be run to open ports for RPC access in
the firewalld profile.
As noted with the second computer it was found that firewalld was not installed
and the only difference at install time was in the option being selected to
install a web server,
The use cases for the installation of firewalld being installed as part of a
default installation without user choice should be reviewed.

#1104530#10
Date:
2025-05-01 17:03:01 UTC
From:
To:
firewalld is not installed as part of the base system. AFAICS it is only
recommended by KDE/Plasma via plasma-firewall.

#1104530#15
Date:
2025-05-03 06:52:13 UTC
From:
To:
(Please reply to the bug mail address, not just mine)

You can check in the installation log /var/log/installer/syslog and in
apt log /var/log/apt/history.log* at the date of installation.

You can also attach them in compressed *.gz form so that the total mail
size does not exceed ~500kB.