Skip to content

[3.0 port]: Install the UFW firewall by default; add -W to opt out #855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antobinary merged 1 commit into from
Sep 30, 2026
Merged

[3.0 port]: Install the UFW firewall by default; add -W to opt out #855

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 19 additions & 16 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,17 +22,18 @@ The full source code for the installation scripts can be found [here](https://gi
So, to install the latest iteration of BigBlueButton 3.0 on a new 64-bit Ubuntu 22.04 server with a public IP address, a hostname (such as `bbb.example.com`) that resolves to the public IP address, and an email address (such as `info@example.com`), log into your new server via SSH and run the following command as root.

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -w -v jammy-300 -s bbb.example.com -e info@example.com
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com
~~~

This command pulls down the latest version of `bbb-install.sh` from BigBlueButton 3.0 branch , sends it to the Bash shell interpreter, and installs BigBlueButton using the parameters provided:

* `-w` installs the uncomplicated firewall (UFW) to restrict access to TCP/IP ports 22, 80, and 443, and UDP ports in range 16384-32768.
* `-v jammy-300` installs the latest iteration of BigBlueButton 3.0.x .
* `-v focal-270` installs the latest iteration of BigBlueButton 2.7.x .
* `-s` sets the server's hostname to be `bbb.example.com`.
* `-e` provides an email address for Let's Encrypt to generate a valid SSL certificate for the host.

The script also installs the uncomplicated firewall (UFW) to restrict access to TCP/IP ports 22, 80, and 443, and UDP ports in range 16384-32768. Pass `-W` to skip it and manage the host firewall yourself.

The hostname `bbb.example.com` and email address `info@example.com` are just sample parameters. The following sections walk you through the details on using `bbb-install.sh` to set up/upgrade your BigBlueButton server.

Note: BigBlueButton meetings will run in a web browser. The browsers now require the use of HTTPS before allowing access to resources such as your webcam, microphone, or screen (for screen sharing) when using the browser's built-in real-time communications (WebRTC) libraries which is the case for BigBlueButton meetings. In other terms, if you try to install BigBlueButton without specifying the `-s` and `-e` parameters, the client will not load.
Expand All @@ -55,7 +56,7 @@ To set up your FQDN, purchase a domain name from a domain name registrar or a we
With your FQDN in place, you can then pass a few additional parameters to `bbb-install.sh` to have it:

* request and install a 4096-bit TLS/SSL certificate from Let's Encrypt (we love Let's Encrypt) (**required**).
* install a firewall to restrict access to only the needed ports (**recommended**).
* install a firewall to restrict access to only the needed ports (**default**; skip with `-W`).
* [install and configure Greenlight](#install-greenlight) to provide a simple front-end for users to enable them to set up rooms, hold online sessions, and manage recordings (**optional**).
* [install and configure BigBlueButton LTI framework](#install-bigbluebutton-lti-framework) to integrate your BigBlueButton server to any Learning Tools Interoperability (LTI) certified platform (that's the majority of known Learning Management Systems (LMS)!) (**optional**).

Expand Down Expand Up @@ -105,7 +106,7 @@ After the instance is created, you need to add a firewall rule to allow incoming

![Google Compute Engine Firewall](images/gce-firewall.png?raw=true "GCE Firewall")

We make a distinction here between the firewall installed with `-w` and the external firewall on a separate server. Even with an external firewall, it is good practice to still install the UFW firewall on the BigBlueButton server.
We make a distinction here between the UFW firewall the script installs on the BigBlueButton server and the external firewall on a separate server. Even with an external firewall, it is good practice to keep the UFW firewall on the BigBlueButton server. The default UFW rules allow SSH only on port 22, so the script stops if sshd listens on another port; pass `-W` to skip UFW and manage the host firewall yourself.


## Command options
Expand Down Expand Up @@ -143,7 +144,9 @@ OPTIONS (install BigBlueButton):
-r <host> Use alternative apt repository (such as packages-eu.bigbluebutton.org)

-d Skip SSL certificates request (use provided certificates from mounted volume) in /local/certs/
-w Install UFW firewall (recommended)
-W Skip UFW firewall configuration (dangerous)
A firewall is required to secure BBB services.
-w Does nothing (Previously: Install UFW firewall)

-j Allows the installation of BigBlueButton to proceed even if not all requirements [for production use] are met.
Note that not all requirements can be ignored. This is useful in development / testing / ci scenarios.
Expand Down Expand Up @@ -210,7 +213,7 @@ Note: we're using `bbb.example.com` as an example hostname and `info@example.com
With just these two pieces of information (FQDN and email address) you can use `bbb-install.sh` to automate the configuration of the BigBlueButton server with a TLS/SSL certificate. For example, to install BigBlueButton with a TLS/SSL certificate from Let's Encrypt using `bbb.example.com` and `info@example.com`, enter the following command:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand All @@ -225,7 +228,7 @@ The default installation is meant to be for servers that are publicly available.
When installing BigBlueButton in a private network, it is possible to validate the FQDN manually, by adding the option `-x` to the command line. As in:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -x [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -x [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand Down Expand Up @@ -293,7 +296,7 @@ More on Greenlight can be found [here](https://docs.bigbluebutton.org/greenlight
To [install Greenlight](https://docs.bigbluebutton.org/greenlight/v3/install#bbb-install-script) you can simply use the `bbb-install.sh` command `-g` option:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -g [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -g [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand All @@ -302,7 +305,7 @@ wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-rel
To install Keycloak just use the `-k` option with `-g`:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -g -k [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -g -k [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand Down Expand Up @@ -371,7 +374,7 @@ The Broker is a Web Application that acts as a LTI Broker for connecting Tool Co
To install the LTI framework you can simply use the `bbb-install.sh` command `-t` option while providing a `KEY:SECRET` which you'll use when deploying the BigBlueButton LTI applications to your platform, for more details about the integration of a tool to your platform please refer to the official documentation of your solution:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -t MY_KEY:MY_SECRET [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -t MY_KEY:MY_SECRET [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand All @@ -384,7 +387,7 @@ You can manage your LTI credentials through the `bbb-install.sh` command using t
- To change the secret of a LTI credential re-run the same with the `-t` option while also using the same **KEY** but a new **SECRET**:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -t MY_KEY:MY_NEW_SECRET [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -t MY_KEY:MY_NEW_SECRET [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand All @@ -395,7 +398,7 @@ This overwrites the old secret, so expect a discontinuity in your integration of
- To add new credentials, re-run the same `bbb-install.sh` command with the `-t` option while also providing new pair of **KEY** and **SECRET**:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -t MY_NEW_KEY:MY_NEW_SECRET [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -t MY_NEW_KEY:MY_NEW_SECRET [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand All @@ -415,7 +418,7 @@ Note: on your system `bbb.example.com` will be substituted with your FQDN.
Updating the LTI framework is done simply through re-running the `bbb-install.sh` anytime while using the `-t` option and providing credentials:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -t KEY:SECRET [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -t KEY:SECRET [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand All @@ -432,7 +435,7 @@ You can become a contributor also!
The install script allows you to pass a path which will be used to create a symbolic link with `/var/bigbluebutton`:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -s bbb.example.com -e info@example.com -v jammy-300 -w -m /mnt/test [options]
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -s bbb.example.com -e info@example.com -v jammy-300 -m /mnt/test [options]
~~~

> [options] is a placeholder for one or more [options](#command-options) that you may use.
Expand All @@ -444,7 +447,7 @@ This allows users to store the contents of /`var/bigbluebutton`, which can get q
If you want to set up BigBlueButton with a TLS/SSL certificate, [GreenLight](#install-greenlight), [Keycloak](https://docs.bigbluebutton.org/greenlight/v3/external-authentication#installing-keycloak) and [BigBlueButton LTI](#install-bigbluebutton-lti-framework) with LTI credentials `MY_KEY:MY_SECRET` , you can do this all with a single command:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -g -k -t MY_KEY:MY_SECRET
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -g -k -t MY_KEY:MY_SECRET
~~~

Note: You'd need to substitute your FQDN, email address and LTI credentials.
Expand All @@ -459,7 +462,7 @@ Furthermore, you can re-run the same `bbb-install.sh` command used for installat
So to update the system in [Doing everything with a single command](#doing-everything-with-a-single-command) example you'd re-run the same command with the same options:

~~~
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -w -g -k -t MY_KEY:MY_SECRET
wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -g -k -t MY_KEY:MY_SECRET
~~~

- `-g` will update Greenlight **and Keycloak** to the latest stable version.
Expand Down
40 changes: 29 additions & 11 deletions bbb-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,13 +24,13 @@
# Examples
#
# Install BigBlueButton 3.0.x with a SSL certificate from Let's Encrypt using hostname bbb.example.com
# and email address info@example.com and apply a basic firewall
# and email address info@example.com (a basic firewall is applied by default)
#
# wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -w -v jammy-300 -s bbb.example.com -e info@example.com
# wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com
#
# Install BigBlueButton with SSL + Greenlight + LiveKit
#
# wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -w -v jammy-300 -s bbb.example.com -e info@example.com -g -L
# wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh | bash -s -- -v jammy-300 -s bbb.example.com -e info@example.com -g -L
#

usage() {
Expand Down Expand Up @@ -67,7 +67,9 @@ OPTIONS (install BigBlueButton):
-r <host> Use alternative apt repository (such as packages-eu.bigbluebutton.org)

-d Skip SSL certificates request (use provided certificates from mounted volume) in /local/certs/
-w Install UFW firewall (recommended)
-W Skip UFW firewall configuration (dangerous)
A firewall is required to secure BBB services.
-w Does nothing (Previously: Install UFW firewall)

-j Allows the installation of BigBlueButton to proceed even if not all requirements [for production use] are met.
Note that not all requirements can be ignored. This is useful in development / testing / ci scenarios.
Expand Down Expand Up @@ -134,7 +136,7 @@ main() {

need_x64

while builtin getopts "hs:r:c:v:e:p:m:t:Lxgadwjik" opt "${@}"; do
while builtin getopts "hs:r:c:v:e:p:m:t:LxgadwWjik" opt "${@}"; do

case $opt in
h)
Expand Down Expand Up @@ -220,11 +222,11 @@ main() {
PROVIDED_CERTIFICATE=true
;;
w)
SSH_PORT=$(grep Port /etc/ssh/ssh_config | grep -v \# | sed 's/[^0-9]*//g')
if [[ -n "$SSH_PORT" && "$SSH_PORT" != "22" ]]; then
err "Detected sshd not listening to standard port 22 -- unable to install default UFW firewall rules."
fi
UFW=true
# Still accepted so existing commands keep working
say "WARNING: -w is deprecated -- the UFW firewall is now installed by default. To opt out, pass -W instead." >&2
;;
W)
SKIP_UFW=true
;;
j)
SKIP_MIN_SERVER_REQUIREMENTS_CHECK=true
Expand Down Expand Up @@ -279,6 +281,10 @@ main() {
check_cpus
check_ipv6

if [ "$SKIP_UFW" != true ]; then
check_ssh_port
fi

need_pkg wget curl gpg-agent dirmngr apparmor-utils

# need_pkg xmlstarlet
Expand Down Expand Up @@ -375,7 +381,7 @@ main() {

systemctl restart systemd-journald

if [ -n "$UFW" ]; then
if [ "$SKIP_UFW" != true ]; then
setup_ufw
fi

Expand Down Expand Up @@ -572,6 +578,18 @@ check_cpus() {
fi
}

check_ssh_port() {
# setup_ufw leaves an existing apply-config.sh untouched, so there is nothing to guard
if [ -f /etc/bigbluebutton/bbb-conf/apply-config.sh ]; then return 0; fi

# The default UFW rules allow SSH only on port 22
local ssh_ports
ssh_ports=$(sshd -T 2>/dev/null | awk '$1 == "port" { print $2 }')
if [ -n "$ssh_ports" ] && ! grep -qx 22 <<< "$ssh_ports"; then
err "Detected sshd not listening to standard port 22 -- unable to install default UFW firewall rules. Pass -W to skip the firewall."
fi
}

check_ubuntu(){
RELEASE=$(lsb_release -r | sed 's/^[^0-9]*//g')
if [ "$RELEASE" != "$1" ]; then err "You must run this command on Ubuntu $1 server."; fi
Expand Down
Loading