> For the complete documentation index, see [llms.txt](https://asus-isg-aidc.gitbook.io/guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://asus-isg-aidc.gitbook.io/guide/latest/cli/commandreference/security.md).

# Security Settings

| Developer | Last modified |
| --------- | ------------- |
| AIDC Team | 2026/07/06    |

## Table of Contents

* [1. Overview](#overview)
* [2. Firewall Management](#firewall-management)
* [3. SELinux Management](#selinux-management)
* [4. Quick Summary](#quick-summary)
* [5. Usage Examples](#usage-examples)

***

## 1. Overview <a href="#overview" id="overview"></a>

{% hint style="warning" %}
**⚠️ Prerequisite: `aidc-cli init` required first**

This command depends on settings saved by [`aidc-cli init`](/guide/latest/cli/commandreference/init.md). Before running it, make sure you have completed:

* [`aidc-cli init inventory`](/guide/latest/cli/commandreference/init.md#inventory) — render the node inventory from `aidc.csv`
* SSH access to the nodes — [`aidc-cli deploy install`](/guide/latest/cli/commandreference/deploy.md) sets this up during OS deployment; for nodes that already have an OS, run [`aidc-cli deploy access-key`](/guide/latest/cli/commandreference/deploy.md) or fill the `password` column in `aidc.csv`

For the full setup sequence, see the [Getting Started](/guide/latest/cli/gettingstarted.md) guide.
{% endhint %}

The `security` command manages firewall rules and SELinux policies on target nodes.

```bash
aidc-cli security <subcommand> [flags]
```

***

## 2. Firewall Management <a href="#firewall-management" id="firewall-management"></a>

### 2.1 `firewall-enable` — Enable Firewall

```bash
aidc-cli security firewall-enable
```

### 2.2 `firewall-disable` — Disable Firewall

```bash
aidc-cli security firewall-disable
```

### 2.3 `firewall-add-rule` — Add Firewall Rule

```bash
aidc-cli security firewall-add-rule [flags]
```

| Flag        | Short | Required | Description                                                  |
| ----------- | :---: | :------: | ------------------------------------------------------------ |
| `--port`    |  `-p` |    ❌\*   | Port/protocol to allow (e.g., `8080/tcp`, `53/udp`)          |
| `--service` |  `-s` |    ❌\*   | Service names to allow (comma-separated, e.g., `http,https`) |

{% hint style="info" %}
At least one of `--port` or `--service` must be specified.
{% endhint %}

### 2.4 `firewall-remove-rule` — Remove Firewall Rule

```bash
aidc-cli security firewall-remove-rule [flags]
```

| Flag        | Short | Required | Description             |
| ----------- | :---: | :------: | ----------------------- |
| `--port`    |  `-p` |    ❌\*   | Port/protocol to remove |
| `--service` |  `-s` |    ❌\*   | Service names to remove |

{% hint style="danger" %}
When using the Security-Firewalld feature, removing the SSH service will result in disconnection from AIDC. Exercise caution when removing critical services.
{% endhint %}

### 2.5 `firewall-list-rule` — List Firewall Rules

```bash
aidc-cli security firewall-list-rule
```

***

## 3. SELinux Management <a href="#selinux-management" id="selinux-management"></a>

### 3.1 `selinux-enable` — Enable SELinux

```bash
aidc-cli security selinux-enable
```

### 3.2 `selinux-disable` — Disable SELinux

```bash
aidc-cli security selinux-disable
```

{% hint style="warning" %}
SELinux changes require a **system reboot** to take effect. When the requested SELinux state differs from the current state, AIDC-CLI reboots target nodes automatically.
{% endhint %}

***

## 4. Quick Summary <a href="#quick-summary" id="quick-summary"></a>

| Subcommand             | Category |     Risk Level     |
| ---------------------- | -------- | :----------------: |
| `firewall-enable`      | Firewall |       🟢 Low       |
| `firewall-disable`     | Firewall |      🟡 Medium     |
| `firewall-add-rule`    | Firewall |       🟢 Low       |
| `firewall-remove-rule` | Firewall |      🟡 Medium     |
| `firewall-list-rule`   | Firewall |       🟢 Low       |
| `selinux-enable`       | SELinux  | 🟡 Medium (reboot) |
| `selinux-disable`      | SELinux  | 🟡 Medium (reboot) |

***

## 5. Usage Examples <a href="#usage-examples" id="usage-examples"></a>

```bash
# Enable firewall on all nodes
aidc-cli security firewall-enable

# Allow HTTP and HTTPS
aidc-cli security firewall-add-rule -s http,https

# Allow custom port
aidc-cli security firewall-add-rule -p 8443/tcp

# Remove a port rule
aidc-cli security firewall-remove-rule -p 8080/tcp

# List all active rules
aidc-cli security firewall-list-rule

# Disable SELinux (AIDC-CLI reboots automatically if the state changes)
aidc-cli security selinux-disable
```