Your message dated Fri, 03 Jul 2026 06:49:33 +0000
with message-id <[email protected]>
and subject line Bug#863802: fixed in ferm 2.7-6
has caused the Debian Bug report #863802,
regarding systemd ordering for firewalls
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
863802: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863802
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: ferm
Version: 2.3-2
Severity: grave
Ferm is broken in stretch for any rule set which contains resolve() statements.
(There might be others relying on network, didn't check). This got introduced
in 2.3-2, which now uses a Wants:/Before: network-pre.target
In jessie, no systemd unit was provided and the sysvinit script translated to
# systemctl cat ferm
# /run/systemd/generator.late/ferm.service
# Automatically generated by systemd-sysv-generator
[Unit]
SourcePath=/etc/init.d/ferm
Description=LSB: ferm firewall configuration
DefaultDependencies=no
Before=sysinit.target
After=network-online.target remote-fs.target
Wants=network-online.target
But since ferm.service is now executed before the network is up, any rule
containing a resolve() statement now leads to a ferm startup failure:
# journalctl -u ferm
-- Logs begin at Wed 2017-05-31 10:53:35 UTC, end at Wed 2017-05-31 11:40:57
UTC. --
May 31 10:53:38 ms-be2001 ferm[1038]: Starting Firewall: fermError in
/etc/ferm/conf.d/10_example line 4:
May 31 10:53:38 ms-be2001 ferm[1038]: just.example.org
May 31 10:53:38 ms-be2001 ferm[1038]: )
May 31 10:53:38 ms-be2001 ferm[1038]:
May 31 10:53:38 ms-be2001 ferm[1038]: )
May 31 10:53:38 ms-be2001 ferm[1038]: <--
May 31 10:53:38 ms-be2001 ferm[1038]: DNS query for 'just.example.org' failed:
query timed out
May 31 10:53:38 ms-be2001 ferm[1038]: failed!
May 31 10:53:38 ms-be2001 systemd[1]: ferm.service: Main process exited,
code=exited, status=101/n/a
May 31 10:53:38 ms-be2001 systemd[1]: Failed to start ferm firewall
configuration.
May 31 10:53:38 ms-be2001 systemd[1]: ferm.service: Unit entered failed state.
May 31 10:53:38 ms-be2001 systemd[1]: ferm.service: Failed with result
'exit-code'.
I'm setting severity to "grave" since this breaks existing setups during the
update
from jessie to stretch.
Possible fixes:
- Revert to the status quo from jessie by reverting the changes from 2.3-2
(ugly)
- Split into two services, e.g. ferm-base.service loading a base rule set which
runs on
network-pre.target and ferm-extended.service which runs on nss-lookup.target or
network.target
Cheers,
Moritz
--- End Message ---
--- Begin Message ---
Source: ferm
Source-Version: 2.7-6
Done: Marc Haber <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ferm, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Marc Haber <[email protected]> (supplier of updated ferm package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 03 Jul 2026 07:59:34 +0200
Source: ferm
Architecture: source
Version: 2.7-6
Distribution: unstable
Urgency: medium
Maintainer: Debian Ferm Maintainers <[email protected]>
Changed-By: Marc Haber <[email protected]>
Closes: 863802 1139303
Changes:
ferm (2.7-6) unstable; urgency=medium
.
* update README
* some fixes to README.source
* implement two-phase startup
Thanks to Moritz Muehlenhoff, David Härdeman, Gabor Kiss,
(Closes: #863802, #1139303)
Checksums-Sha1:
29990498d926e9300b3f8e830384dc945f38cc2e 2113 ferm_2.7-6.dsc
c5db4e4447db0775a8e1acc1b911b6612823863a 24260 ferm_2.7-6.debian.tar.xz
Checksums-Sha256:
7d1d2a583882c43b6c2987c3982fad25e419856553b801b62b528d90993cf0d0 2113
ferm_2.7-6.dsc
5888c06f696ef117fb0bb3042e24624999c82ddb19e216334c200aed369ee8b9 24260
ferm_2.7-6.debian.tar.xz
Files:
a0a36288831a5a99ac034b3c465befdd 2113 net optional ferm_2.7-6.dsc
ea6a92629b61ac89f00f10ad2a3069d8 24260 net optional ferm_2.7-6.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE6QL5UJ/L0pcuNEbjj3cgEwEyBEIFAmpHVtkACgkQj3cgEwEy
BEJ3+hAA291PxpWsuR/zhTDKBtJsff6z/l1tk23M0v6dLTmhpet53ZbCjMb543dy
3rP2xzWo/4MqURtsNNv/jZKXwAmCnUf8ctoQ2csB58/MSNujuMGsjH8EpbB2w//s
oVDzF9s9A2m2dqxk4SA9m462wTpBRhkqIkFHPHr8IDPIyl80qxleRYa8S8yc8Cfd
ug0x/QDvpxIlNHr1AAbAc0v+n3kZ81CFvVBgmhNMnLnaIxapfSLP1kim4WVGnYd2
n+OElI854CgLA2Hlj1spDS1eTRnVSweTEbGW7/GR6Kuh19ujvQIoYTP7sEmdf7JZ
mfK9n1rbjVpouRikzOQd9PGVXBwZqh3uIRHuS1Oay1bGmVoitFCWOG95Cr6XagFd
b5xXv1lK7QuNTb66ZZWZDsaG9K91+4RSj4DYIhaljq9HayHyO+SGo4CS0kGikkVG
xN5g37D30OpxdLHDWzyfSconG05Fal4E5EeIx8oDZz18Iun9eCmsKaflh1izPSsD
OVck0Ul5o+eElBgtm869WKND8EU756qQK+OKqm8Cvr+4utzbkM65C32yM8LENSIC
+C8C0rGVMtjyz/tQfEEiRtAMUQRyHopFMIaGepwP1sBrlUM+5fyXvgxJM0CQHe3Z
jNzG6v5iNLYC46ztMiGXGhvQ6wI4hoeUp+BsAxO6TTTsNxj4LRg=
=jIwT
-----END PGP SIGNATURE-----
pgpOwQUXDu5mq.pgp
Description: PGP signature
--- End Message ---
