modules/ferm/manifests/init.pp

   1 class ferm {
   2         define rule($domain="ip", $chain="INPUT", $rule, $description="", $prio="00") {
   3                 file { "/etc/ferm/dsa.d/${prio}_${name}":
   4                         ensure  => present,
   5                         owner   => root,
   6                         group   => root,
   7                         mode    => 0600,
   8                         content => template("ferm/ferm-rule.erb"),
   9                         notify  => Exec["ferm restart"],
  10                 }
  11         }
  12
  13         package { ferm: ensure => installed }
  14
  15         file {
  16                 "/etc/ferm/dsa.d":
  17                         ensure => directory,
  18                         require => Package["ferm"];
  19                 "/etc/ferm/conf.d":
  20                         ensure => directory,
  21                         require => Package["ferm"];
  22                 "/etc/ferm/ferm.conf":
  23                         source  => "puppet:///ferm/ferm.conf",
  24                         require => Package["ferm"],
  25                         notify  => Exec["ferm restart"];
  26                 "/etc/ferm/conf.d/me.conf":
  27                         content => template("ferm/me.conf.erb"),
  28                         require => Package["ferm"],
  29                         notify  => Exec["ferm restart"];
  30                 "/etc/ferm/conf.d/defs.conf":
  31                         source  => "puppet:///ferm/defs.conf",
  32                         require => Package["ferm"],
  33                         notify  => Exec["ferm restart"];
  34         }
  35
  36         ferm::rule { "dsa-ssh":
  37                 description     => "Allow SSH from DSA",
  38                 rule            => "domain (ip ip6) proto tcp mod state state (NEW) dport (ssh) @subchain 'ssh' { saddr (\$SSH_SOURCES) ACCEPT; }"
  39         }
  40
  41         exec { "ferm restart":
  42                 path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
  43                 refreshonly => true,
  44         }
  45 }