Install the UFW firewall by default; add -W to opt out

[antobinary]

What

bbb-install.sh now sets up the UFW firewall on every BigBlueButton install unless -W is passed. Until now the firewall was only set up when -w was passed.

Changes

• -W (new): skips the firewall setup.

• -w: still accepted, so existing install and upgrade commands keep working. It no longer changes anything and prints a deprecation warning:

  bbb-install: WARNING: -w is deprecated -- the UFW firewall is now installed by default. To opt out, pass -W instead.
  

• SSH port guard: moved out of the -w handler into a new check_ssh_port, which runs with the other pre-install checks, before anything is installed.

  • It now reads the effective server configuration from sshd -T. The old check grepped /etc/ssh/ssh_config, which is the client configuration, so it practically never fired.
  • If sshd does not listen on port 22 the install stops with an error pointing at -W, because enableUFWRules only allows SSH on port 22 and would lock the admin out.
  • The guard is skipped when -W is passed, or when /etc/bigbluebutton/bbb-conf/apply-config.sh already exists (the script leaves an existing file untouched, so there is nothing to guard).

• Docs: -w is removed from every example in the help text, the script header and the README quickstart. The README firewall paragraph describes the new default and -W.

Behaviour changes to be aware of

• Upgrades enable the firewall. A server that was installed without -w gets UFW enabled the next time the install command is re-run, unless it already has an apply-config.sh.
• Non-standard SSH port. A server with sshd on a port other than 22 now stops with an error unless -W is passed. Previously it only hit this path with -w.
• -W does not disable UFW. It only skips the setup; a firewall that is already enabled stays enabled.
• Coturn-only installs are unchanged. Running without -v still does not set up UFW.
• Known gap. An SSH port changed only through an ssh.socket override, without touching sshd_config, is not detected.

Testing

Check	Result
bash -n bbb-install.sh	PASS
-h, -w -h, -W -h parse and print the help	PASS
Warning printed only when -w is passed	PASS
check_ssh_port with stubbed sshd on port 22	PASS (continues)
check_ssh_port with stubbed sshd on port 2222	PASS (stops with error)
check_ssh_port with stubbed sshd on ports 22 and 2222	PASS (continues)
check_ssh_port with no sshd installed	PASS (continues)
default clean installation	PASS

[kepstin]

Code changes look fine, I just have some minor recommendations for improving the script's help text.