From e63c8f520153204ce1bee4f4aca2b6eb0308a3f0 Mon Sep 17 00:00:00 2001 From: Stephen Gran Date: Sun, 25 Jul 2010 20:59:50 +0100 Subject: [PATCH 1/1] try to start breaking up firewall rules into something not quite as messy Signed-off-by: Stephen Gran --- manifests/site.pp | 104 ----------------------------- modules/ferm/manifests/ftp.pp | 7 ++ modules/ferm/manifests/per-host.pp | 86 ++++++++++++++++++++++++ modules/ferm/manifests/rsync.pp | 8 +++ modules/ferm/manifests/zivit.pp | 15 +++++ 5 files changed, 116 insertions(+), 104 deletions(-) create mode 100644 modules/ferm/manifests/ftp.pp create mode 100644 modules/ferm/manifests/per-host.pp create mode 100644 modules/ferm/manifests/rsync.pp create mode 100644 modules/ferm/manifests/zivit.pp diff --git a/manifests/site.pp b/manifests/site.pp index 03d6a1405..c00138fc2 100644 --- a/manifests/site.pp +++ b/manifests/site.pp @@ -96,110 +96,6 @@ node default { } } } - - case $hostname { - ancina,zandonai,zelenka: { - @ferm::rule { "dsa-zivit-rrdcollect": - description => "port 6666 for rrdcollect for zivit", - rule => "&SERVICE_RANGE(tcp, 6666, ( 10.130.18.71 ))" - } - @ferm::rule { "dsa-zivit-zabbix": - description => "port 10050 for zabbix for zivit", - rule => "&SERVICE_RANGE(tcp, 10050, ( 10.130.18.76 ))" - } - @ferm::rule { "dsa-time": - description => "Allow time access", - rule => "&SERVICE_RANGE(tcp, time, \$HOST_NAGIOS_V4)" - } - } - piatti: { - @ferm::rule { "dsa-udd-stunnel": - description => "port 8080 for udd stunnel", - rule => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))" - } - } - senfl: { - @ferm::rule { "dsa-rsync": - domain => "(ip ip6)", - description => "Allow rsync access", - rule => "&SERVICE(tcp, 873)" - } - } - saens,villa,lobos,raff,gluck,schein,wieck,steffani,ries,rietz,franck,morricone,valente,klecker: { - @ferm::rule { "dsa-ftp": - domain => "(ip ip6)", - description => "Allow ftp access", - rule => "&SERVICE(tcp, 21)" - } - @ferm::rule { "dsa-rsync": - domain => "(ip ip6)", - description => "Allow rsync access", - rule => "&SERVICE(tcp, 873)" - } - } - handel: { - @ferm::rule { "dsa-puppet": - description => "Allow puppet access", - rule => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)" - } - @ferm::rule { "dsa-puppet-v6": - domain => 'ip6', - description => "Allow puppet access", - rule => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)" - } - } - powell: { - @ferm::rule { "dsa-powell-v6-tunnel": - description => "Allow powell to use V6 tunnel broker", - rule => "proto ipv6 saddr 212.227.117.6 jump ACCEPT" - } - @ferm::rule { "dsa-powell-btseed": - domain => "(ip ip6)", - description => "Allow powell to seed BT", - rule => "proto tcp dport 8000:8100 jump ACCEPT" - } - @ferm::rule { "dsa-powell-rsync": - description => "Hoster wants to sync from here, and why not", - rule => "&SERVICE_RANGE(tcp, rsync, ( 195.20.242.90 192.25.206.33 82.195.75.106 206.12.19.118 ))" - } - } - beethoven: { - @ferm::rule { "dsa-merikanto-beethoven": - description => "Allow merikanto", # for nfs, and that uses all kind of ports by default. - rule => "source 172.22.127.147 interface bond0 jump ACCEPT", - } - } - heininen: { - @ferm::rule { "dsa-syslog": - description => "Allow syslog access", - rule => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)" - } - @ferm::rule { "dsa-syslog-v6": - domain => 'ip6', - description => "Allow syslog access", - rule => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)" - } - } - kaufmann: { - @ferm::rule { "dsa-hkp": - domain => "(ip ip6)", - description => "Allow hkp access", - rule => "&SERVICE(tcp, 11371)" - } - @ferm::rule { "dsa-rsync": - domain => "(ip ip6)", - description => "Allow rsync access", - rule => "&SERVICE(tcp, 873)" - } - } - liszt: { - @ferm::rule { "smtp": - domain => "(ip ip6)", - description => "Allow smtp access", - rule => "&SERVICE(tcp, 25)" - } - } - } case $brokenhosts { "true": { include hosts } } diff --git a/modules/ferm/manifests/ftp.pp b/modules/ferm/manifests/ftp.pp new file mode 100644 index 000000000..7c666a1f8 --- /dev/null +++ b/modules/ferm/manifests/ftp.pp @@ -0,0 +1,7 @@ +class ferm::ftp { + @ferm::rule { "dsa-ftp": + domain => "(ip ip6)", + description => "Allow ftp access", + rule => "&SERVICE(tcp, 21)" + } +} diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp new file mode 100644 index 000000000..b494c2a94 --- /dev/null +++ b/modules/ferm/manifests/per-host.pp @@ -0,0 +1,86 @@ +class ferm::per-host { + + case $hostname { + ancina,zandonai,zelenka: { + include ferm::zivit + } + } + case $hostname { + franck,gluck,kaufmann,klecker,lobos,morricone,raff,ries,rietz,saens,schein,senfl,steffani,valente,villa,wieck: { + include ferm::rsync + } + } + + case $hostname { + saens,villa,lobos,raff,gluck,schein,wieck,steffani,ries,rietz,franck,morricone,valente,klecker: { + include ferm::ftp + } + } + + case $hostname { + piatti: { + @ferm::rule { "dsa-udd-stunnel": + description => "port 8080 for udd stunnel", + rule => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))" + } + } + + handel: { + @ferm::rule { "dsa-puppet": + description => "Allow puppet access", + rule => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)" + } + @ferm::rule { "dsa-puppet-v6": + domain => 'ip6', + description => "Allow puppet access", + rule => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)" + } + } + powell: { + @ferm::rule { "dsa-powell-v6-tunnel": + description => "Allow powell to use V6 tunnel broker", + rule => "proto ipv6 saddr 212.227.117.6 jump ACCEPT" + } + @ferm::rule { "dsa-powell-btseed": + domain => "(ip ip6)", + description => "Allow powell to seed BT", + rule => "proto tcp dport 8000:8100 jump ACCEPT" + } + @ferm::rule { "dsa-powell-rsync": + description => "Hoster wants to sync from here, and why not", + rule => "&SERVICE_RANGE(tcp, rsync, ( 195.20.242.90 192.25.206.33 82.195.75.106 206.12.19.118 ))" + } + } + beethoven: { + @ferm::rule { "dsa-merikanto-beethoven": + description => "Allow merikanto", # for nfs, and that uses all kind of ports by default. + rule => "source 172.22.127.147 interface bond0 jump ACCEPT", + } + } + heininen: { + @ferm::rule { "dsa-syslog": + description => "Allow syslog access", + rule => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)" + } + @ferm::rule { "dsa-syslog-v6": + domain => 'ip6', + description => "Allow syslog access", + rule => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)" + } + } + kaufmann: { + @ferm::rule { "dsa-hkp": + domain => "(ip ip6)", + description => "Allow hkp access", + rule => "&SERVICE(tcp, 11371)" + } + } + liszt: { + @ferm::rule { "smtp": + domain => "(ip ip6)", + description => "Allow smtp access", + rule => "&SERVICE(tcp, 25)" + } + } + } +} diff --git a/modules/ferm/manifests/rsync.pp b/modules/ferm/manifests/rsync.pp new file mode 100644 index 000000000..390bce2bd --- /dev/null +++ b/modules/ferm/manifests/rsync.pp @@ -0,0 +1,8 @@ +class ferm::rsync { + @ferm::rule { "dsa-rsync": + domain => "(ip ip6)", + description => "Allow rsync access", + rule => "&SERVICE(tcp, 873)" + } +} + diff --git a/modules/ferm/manifests/zivit.pp b/modules/ferm/manifests/zivit.pp new file mode 100644 index 000000000..e392b3fe9 --- /dev/null +++ b/modules/ferm/manifests/zivit.pp @@ -0,0 +1,15 @@ +class ferm::zivit { + @ferm::rule { "dsa-zivit-rrdcollect": + description => "port 6666 for rrdcollect for zivit", + rule => "&SERVICE_RANGE(tcp, 6666, ( 10.130.18.71 ))" + } + @ferm::rule { "dsa-zivit-zabbix": + description => "port 10050 for zabbix for zivit", + rule => "&SERVICE_RANGE(tcp, 10050, ( 10.130.18.76 ))" + } + @ferm::rule { "dsa-time": + description => "Allow time access", + rule => "&SERVICE_RANGE(tcp, time, \$HOST_NAGIOS_V4)" + } +} + -- 2.20.1