Merge remote-tracking branch 'waldi/rsyncd-vsftpd-systemd-all'

* waldi/rsyncd-vsftpd-systemd-all:
  Another try to fix xinetd vs. systemd
  Pull in ftp conntrack in vsftpd site
  Use rsyncd via systemd on bugs_mirror
  Use rsyncd via systemd on wiki
  Use rsyncd via systemd on snapshot
  Use vsftpd via systemd on ftp
  Use rsyncd via systemd on syncproxy
  Use rsyncd and vsftpd via systemd on security_mirror
  Fix dependencies between service and xinetd

diff --git a/modules/ferm/manifests/ftp_conntrack.pp b/modules/ferm/manifests/ftp_conntrack.pp
index ea502e2..45e060b 100644 (file)
--- a/modules/ferm/manifests/ftp_conntrack.pp
+++ b/modules/ferm/manifests/ftp_conntrack.pp
@@ -1,3 +1,24 @@
 class ferm::ftp_conntrack {
-       ferm::module { 'nf_conntrack_ftp': }
+       # This also works for jessie hosts, but requires a reboot
+       if (versioncmp($::lsbmajdistrelease, '9') >= 0) {
+               # Allow non-passive connections to an FTP server
+               @ferm::rule { 'dsa-ftp-conntrack-client':
+                       domain      => '(ip ip6)',
+                       description => 'ftp client connection tracking',
+                       table       => 'raw',
+                       chain       => 'OUTPUT',
+                       rule        => 'proto tcp dport 21 CT helper ftp'
+               }
+
+               # Allow passive connections from an FTP client
+               @ferm::rule { 'dsa-ftp-conntrack-server':
+                       domain      => '(ip ip6)',
+                       description => 'ftp server connection tracking',
+                       table       => 'raw',
+                       chain       => 'PREROUTING',
+                       rule        => 'proto tcp dport 21 CT helper ftp'
+               }
+       } else {
+               ferm::module { 'nf_conntrack_ftp': }
+       }
 }