1

We have an RHEL 6.5 system which boots to the point of loading APF firewall and then just hangs indefinitely. The console shows the following:

...
Loading autofs4: [OK]
Starting automount: [OK]
Starting SWsoft control panels server... [OK]
Starting APF: ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (16384 buckets, 65536 max)

enter image description here

It then waits indefinitely on the screen above. The only way we have been able to work around this was to disable the APF service from starting at boot.

/var/log/messages shows the following:

May  9 04:15:29 sapphire acpid: waiting for events: event logging is off
May  9 04:15:29 sapphire acpid: client connected from 6777[68:68]
May  9 04:15:29 sapphire acpid: 1 client rule loaded
May  9 04:15:30 sapphire automount[6797]: lookup_read_master: lookup(nisplus): couldn't locate nis+ table auto.master
May  9 04:15:31 sapphire kernel: ip_tables: (C) 2000-2006 Netfilter Core Team
May  9 04:15:31 sapphire kernel: nf_conntrack version 0.5.0 (16384 buckets, 65536 max)

/var/log/apf_log consistently shows the following as the last lines before boot hangs:

May 09 04:15:33 server apf(6915): {dshield} downloading http://feeds.dshield.org/top10-2.txt
May 09 04:15:33 server apf(6915): {dshield} parsing top10-2.txt into /etc/apf/ds_hosts.rules
May 09 04:15:33 server apf(6915): {dshield} loading ds_hosts.rules

May 09 04:30:50 server apf(2681): {dshield} downloading http://feeds.dshield.org/top10-2.txt
May 09 04:30:51 server apf(2681): {dshield} parsing top10-2.txt into /etc/apf/ds_hosts.rules
May 09 04:30:51 server apf(2681): {dshield} loading ds_hosts.rules

May 09 04:48:45 server apf(2653): {dshield} downloading http://feeds.dshield.org/top10-2.txt
May 09 04:48:46 server apf(2653): {dshield} parsing top10-2.txt into /etc/apf/ds_hosts.rules
May 09 04:48:46 server apf(2653): {dshield} loading ds_hosts.rules

So it would seem that loading of the DShield rules is causing boot to hang.

After successfully booting, both iptables and APF are running fine.

Can anyone suggest how to troubleshoot this?

6
  • What does /var/log/messages say for the failed boots? You may also want to SET_VERBOSE recreate the issue and check /var/log/apf_log – Bratchley May 9 '14 at 15:43
  • Added info from /var/log/messages to original question - nothing particularly obvious there. How do we do SET_VERBOSE? – Chris May 9 '14 at 15:48
  • It's a configuration option. See Section 3.1 – Bratchley May 9 '14 at 16:26
  • Just checked and SET_VERBOSE is already enabled in /etc/apf/conf.apf so that isn't the problem. It looks as if nf_conntrack is causing the problem as it's the last line in the logs... – Chris May 9 '14 at 18:27
  • Last in both logs? Also, it could have just been the last thing to succeed. Looking at your messages output, do you use automount? Might a required directory not be mount until after boot time? – Bratchley May 9 '14 at 19:35
0

This issue appears to have fixed itself as rebooting with the same configuration now works fine. As the system boot was hanging when loading the dynamically downloaded ds_hosts.rules file from DShield, we can only assume that there was a problem with this file which has since been updated as nothing else has changed on the system.

The temporary workaround, while the server would not boot, was to disable APF at startup by booting in to single-user mode and then running:

chkconfig apf off

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.