Shoreline Firewall (Shorewall)

>
> --- Tom Eastep <teastep@...> wrote:
>
>> Can we move this to the development list? Seems like
>> a more appropriate
>> forum.
>
> Maybe I shouldn't repost the message but I'm doing it
> for clarity's sake.
> I would also like to add that Gentoo users do have a
> script for merging config files "easily".
> They usually use either dispatch-conf or etc-update.
> It's very powerful because you can selectively merge
> lines from the old and new config files.
> So basically Gentoo users already have a neat tool to
> upgrade Shorewall files.

I know those tools and I'm jealous... that's why I made my own, which is
not so powerful but does what I need.

>
> Maybe the only thing that would make it even easier
> and faster is if most of the comments could move to
> documentation. But on the other hand I also think that
> a detailed but minimalist synopsis should be
> conserved. See below.

I still don't really like it. Why not have a .txt file for every config
file which holds the comments? Like

zones
zones.txt
rules
rules.txt
interfaces
interfaces.txt

Then, the package management could always overwrite the .txt files and
never has to care about any real config file.

Simon

--- Simon Matter <simon.matter@...> wrote:

> I still don't really like it. Why not have a .txt
> file for every config
> file which holds the comments? Like
> 
> zones
> zones.txt
> rules
> rules.txt
> interfaces
> interfaces.txt
> 
> Then, the package management could always overwrite
> the .txt files and
> never has to care about any real config file.

That was my original thought too but that would imply
moving the *.txt to something like /usr/share/doc. Why
keep them in the config dir?
It's a solution anyway but what I like about the
current config files is that you have all the keywords
at your fingertips. I don't have to open another
console to read a doc file unless I need more info on
a specific command/option. That's why I proposed to
leave a few lines with only a "quick reference" to
Shorewall syntax.
But of course I realize that it would also double the
maintenance (config headers + full documentation).

I must say however that leaving the *.txt files in the
config dir might be better than moving them to the doc
dir because the update script would then force the
user to "see the version changes" and avoid errors.


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

>
>
> --- Simon Matter <simon.matter@...> wrote:
>
>> I still don't really like it. Why not have a .txt
>> file for every config
>> file which holds the comments? Like
>>
>> zones
>> zones.txt
>> rules
>> rules.txt
>> interfaces
>> interfaces.txt
>>
>> Then, the package management could always overwrite
>> the .txt files and
>> never has to care about any real config file.
>
> That was my original thought too but that would imply
> moving the *.txt to something like /usr/share/doc. Why
> keep them in the config dir?

I'd keep them just for convenience, even if they don't really belong
there. ( Some other software like squid also does this somehow, you
usually find /etc/squid/squid.conf.default which is something I like.)

> It's a solution anyway but what I like about the
> current config files is that you have all the keywords
> at your fingertips. I don't have to open another
> console to read a doc file unless I need more info on
> a specific command/option. That's why I proposed to
> leave a few lines with only a "quick reference" to
> Shorewall syntax.
> But of course I realize that it would also double the
> maintenance (config headers + full documentation).
>
> I must say however that leaving the *.txt files in the
> config dir might be better than moving them to the doc
> dir because the update script would then force the
> user to "see the version changes" and avoid errors.

One more idea: You can still cut'n'paste the relevant parts of the .txt
files to your real config files. Everybody is free to do that but I don't
think it makes sense to include parts of the .txt file in the config
files.
So, it still seems the easiest solution to have the documentation in .txt
(or .sample) files and keep the real config files clean.
Let's wait what Tom has to say about it, he usually comes up with an even
better solution :)

Simon