Declarative policy
Groups and per-host allow-lists in JSON (or YAML). A host's rules become exactly what the policy says.
RHEL 9 fleet tooling · over SSH
linux-firewall
Describe what each host may expose, then hold firewalld to it. Diff against a policy and reconcile, with an SSH lockout guard.
$ git clone https://github.com/vikozs/linux-firewall
linux-firewall discover -H hosts.txt -u sa.vko --policy policy.json --ask-ssh-pass --sudo-pass-same-as-ssh web01.zav-mb.loc 4 change(s) guard.zav-mb.loc 0 change(s) 2 blocked nftbox.zav-mb.loc nftables (not diffed) Plan: firewall_plan.json Report: firewall_report.xlsx Totals: 4 changes, 2 blocked, 2 rt/perm drift
How it works
01
discover
read the effective ruleset, diff vs policy
02
review
see adds, removes, and blocked changes
03
apply
reconcile, re-validated live, then verify
What it does
SSH lockout guard
A change that would drop the ssh service or your control SSH port is blocked unless you --force it.
Won't strip the unlisted
A host absent from the policy is unmanaged: its extra rules are reported, never removed.
Runtime vs permanent
Surfaces rules that live in one but not the other. apply writes permanent, reloads, then verifies.
Output
A report you can hand to anyone
A formatted Excel workbook plus a machine-readable JSON plan. Sheets:
SummaryPolicy DriftEffective RulesRuntime vs PermanentErrorsAbout
Safety
GUARDED
The SSH lockout guard blocks any change that would cut your access. Unmanaged hosts are never reconciled.
The rest of the family