Ubuntu firewall revisited

A bit of grepping in /etc helped me understand why the numerous runs of ubuntu-firewall.sh (home page here). Ubuntu uses /etc/network/interfaces in order to, well, configure network interfaces and the guys seem to have thought that it's good to put there a number of devices, just in case, all of them made to use DHCP. That's not too good for me, since I only have one network card connected to an ADSL modem. Also, the firewall script is called every time dhclient is called (the dhclient-exit-hooks script called when dhclient exits has '/etc/init.d/ubuntu-firewall.sh reload' in it) - thus, the multiple runs.

So, we have eth0, eth1, eth2, wlan0 and ath0 on by default, and dhclient is run for each of them (setting RUN=yes in /etc/dhcp3/dhclient-exit-hooks.d/debug and examining /tmp/dhclient-script.debug shows this clearly), and also the firewall script. So I got rid of the unneeded interfaces. Now, the debug log also shows that the dhclient exit hooks have been called twice for eth0. Every time the scripts are called there is a number of variables that are passed to it, and the one that caught my eye was 'reason' - the first time around it is 'PREINIT', the second time it's set to 'BOUND' - after the address is acquired.

The reason values are enumerated and explained in the dhclient-script man page. However, even after reading the man page I'm not that sure whether it makes sense to reload the firewall script when reason is 'PREINIT', since that stage is hit even for non-existent interfaces. Maybe I could run 'ifconfig interface' in the script and check whether anything happened with it (if there's no alias for the ethX or whatever other device, I guess it shouldn't show up under ifconfig). Also, I think server programs like sshd should be run *after* dhclient3, so before acquiring an address I don't think there's any danger of a hacker intrusion (unless it's something DHCP related). Oh well, who knows.