firewall: mark /etc/firewall.user as conffile