majic-ansible-roles Changeset

Changeset - 7df70ebc439c

Parent rev.

Child rev.

[Not reviewed]

0 9 0

Branko Majic (branko) - 9 years ago 2016-12-10 11:06:13
branko@majic.rs

MAR-85: Updated all role firewall deployment rules to cover IPv6 in addition to IPv4. Update instructions to make it clear that an additional Python package is required.

9 files changed with 157 insertions and 80 deletions:

docs/index.rst

docs/usage.rst

roles/backup_server/templates/ferm_backup.conf.j2

roles/common/templates/00-base.conf.j2

roles/ldap_server/files/ferm_ldap.conf

roles/mail_forwarder/templates/ferm_mail.conf.j2

roles/mail_server/files/ferm_mail.conf

roles/web_server/files/ferm_http.conf

roles/xmpp_server/files/ferm_xmpp.conf

0 comments (0 inline, 0 general)

docs/index.rst

➞

Show inline comments

@@ @@ -18,6 +18,10 @@ are: @@
 * Referencing non-existing handlers does not produce error.
 * Referencing non-existing tags does not produce error.
 The role also utilises the ``dig`` lookup plugin which requires ``dnspython``
 package to be installed. Make sure you have the package available on controller
 machine.
 Contents
 ========

docs/usage.rst

➞

Show inline comments

      mkdir ~/mysite/
      mkvirtualenv -a ~/mysite/ mysite
      pip install -U pip setuptools
      pip install 'ansible~=1.9.0'
      pip install 'ansible~=1.9.0' dnspython
 .. warning::
    The ``dnspython`` package is important since it is used internally via
    ``dig`` lookup plugin.
 Cloning the *Majic Ansible Roles*

roles/backup_server/templates/ferm_backup.conf.j2

➞

Show inline comments

 {% if backup_clients -%}
 table filter {
     chain INPUT {
         saddr ({% for client in backup_clients %} {{ client.ip }}{% endfor %}) @subchain "backup_in" {
             # SSH
             proto tcp dport 2222 ACCEPT;
 domain (ip ip6) {
     table filter {
         chain INPUT {
             saddr ({% for client in backup_clients %} {{ client.ip }}{% endfor %}) @subchain "backup_in" {
                 # SSH
                 proto tcp dport 2222 ACCEPT;
+            }
+        }
+    }
+}

roles/common/templates/00-base.conf.j2

➞

Show inline comments

 table filter {
     chain INPUT {
         policy DROP;
         interface lo ACCEPT;
         # Make sure not to allow flooding via ICMP ping packages by sending them
         # to flood chain before state module kicks in.
         proto icmp icmp-type echo-request jump flood;
         mod state state (ESTABLISHED RELATED) ACCEPT;
         # For TCP packages we perform floods checks after state module took care
         # of established and related connections.
         proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
         # Accept some common incoming connections.
         proto icmp icmp-type echo-request ACCEPT;
         proto tcp dport 22 ACCEPT;
 # IPv4
 domain ip {
     table filter {
         chain INPUT {
             policy DROP;
             interface lo ACCEPT;
             # Make sure not to allow flooding via ICMP ping packages by sending them
             # to flood chain before state module kicks in.
             proto icmp icmp-type echo-request jump flood;
             mod state state (ESTABLISHED RELATED) ACCEPT;
             # For TCP packages we perform floods checks after state module took care
             # of established and related connections.
             proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
             # Accept some common incoming connections.
             proto icmp icmp-type echo-request ACCEPT;
             proto tcp dport 22 ACCEPT;
+        }
         # The flood chain is used for controlling the rate of the incoming connections.
         chain flood {
             # Rate-limit the ping requests.
             proto icmp icmp-type echo-request {
                 mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                     hashlimit-mode srcip hashlimit-name icmp RETURN;
                 DROP;
+            }
             # Rate-limit the TCP connections.
             proto tcp tcp-flags (FIN SYN RST ACK) SYN {
                 mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                     hashlimit-mode srcip hashlimit-name icmp RETURN;
                 LOG;
                 DROP;
+            }
+        }
+    }
+}
     # The flood chain is used for controlling the rate of the incoming connections.
     chain flood {
         # Rate-limit the ping requests.
         proto icmp icmp-type echo-request {
             mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                 hashlimit-mode srcip hashlimit-name icmp RETURN;
             DROP;
 # IPv6, same as IPv4 config, with addition of a couple of ICMP packets.
 domain ip6 {
     table filter {
         chain INPUT {
             policy DROP;
             interface lo ACCEPT;
             # Make sure not to allow flooding via ICMP ping packages by sending them
             # to flood chain before state module kicks in.
             proto icmp icmp-type echo-request jump flood;
             mod state state (ESTABLISHED RELATED) ACCEPT;
             # For TCP packages we perform floods checks after state module took care
             # of established and related connections.
             proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
             # ICMPv6 packets required for proper functioning of IPv6.
             proto icmp icmp-type router-advertisement ACCEPT;
             proto icmp icmp-type neighbor-solicitation ACCEPT;
             proto icmp icmp-type neighbor-advertisement ACCEPT;
             # Accept some common incoming connections.
             proto icmp icmp-type echo-request ACCEPT;
             proto tcp dport 22 ACCEPT;
+        }
         # Rate-limit the TCP connections.
         proto tcp tcp-flags (FIN SYN RST ACK) SYN {
             mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                 hashlimit-mode srcip hashlimit-name icmp RETURN;
             LOG;
             DROP;
         # The flood chain is used for controlling the rate of the incoming connections.
         chain flood {
             # Rate-limit the ping requests.
             proto icmp icmp-type echo-request {
                 mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                     hashlimit-mode srcip hashlimit-name icmp RETURN;
                 DROP;
+            }
             # Rate-limit the TCP connections.
             proto tcp tcp-flags (FIN SYN RST ACK) SYN {
                 mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                     hashlimit-mode srcip hashlimit-name icmp RETURN;
                 LOG;
                 DROP;
+            }
+        }
+    }
+}

roles/ldap_server/files/ferm_ldap.conf

➞

Show inline comments

 table filter {
     chain INPUT {
         proto tcp dport 389 ACCEPT;
         proto tcp dport 636 ACCEPT;
 domain (ip ip6) {
     table filter {
         chain INPUT {
             proto tcp dport 389 ACCEPT;
             proto tcp dport 636 ACCEPT;
+        }
+    }
+}
@@ \ No newline at end of file @@
+}

roles/mail_forwarder/templates/ferm_mail.conf.j2

➞

Show inline comments

 {% if smtp_relay_host %}
 # Accept incoming connections on port 25 from SMTP relay host.
 table filter {
     chain INPUT {
         # SMTP for server communication.
         proto tcp dport 25 {
             saddr {{ smtp_relay_host }} ACCEPT;
 domain ip {
     # Accept incoming connections on port 25 from SMTP relay host.
     table filter {
         chain INPUT {
             # SMTP for server communication.
             proto tcp dport 25 {
                 saddr {{ smtp_relay_host }} ACCEPT;
+            }
+        }
+    }
+}
 {% if lookup('dig', smtp_relay_host + '/AAAA') not in ['NXDOMAIN', ''] %}
 domain ip6 {
     # Accept incoming connections on port 25 from SMTP relay host.
     table filter {
         chain INPUT {
             # SMTP for server communication.
             proto tcp dport 25 {
                 saddr {{ smtp_relay_host }} ACCEPT;
+            }
+        }
+    }
+}
 {% endif %}
 {% endif %}

roles/mail_server/files/ferm_mail.conf

➞

Show inline comments

 table filter {
     chain INPUT {
         # SMTP for server communication.
         proto tcp dport 25 ACCEPT;
         # SMTP for client submission (with alternative port)
         proto tcp dport 587 ACCEPT;
         proto tcp dport 26 ACCEPT;
         # IMAP
         proto tcp dport 143 ACCEPT;
         proto tcp dport 993 ACCEPT;
         # ManageSieve
         proto tcp dport 4190 ACCEPT;
 domain (ip ip6) {
     table filter {
         chain INPUT {
             # SMTP for server communication.
             proto tcp dport 25 ACCEPT;
             # SMTP for client submission (with alternative port)
             proto tcp dport 587 ACCEPT;
             proto tcp dport 26 ACCEPT;
             # IMAP
             proto tcp dport 143 ACCEPT;
             proto tcp dport 993 ACCEPT;
             # ManageSieve
             proto tcp dport 4190 ACCEPT;
+        }
+    }
+}
 table nat {
     chain PREROUTING {
         # Set-up redirection for alternate SMTP port (to avoid ISP/hotel blocks
         # etc).
         proto tcp dport 26 REDIRECT to-ports 587;
     table nat {
         chain PREROUTING {
             # Set-up redirection for alternate SMTP port (to avoid ISP/hotel blocks
             # etc).
             proto tcp dport 26 REDIRECT to-ports 587;
+        }
+    }
+}
+}
@@ \ No newline at end of file @@

roles/web_server/files/ferm_http.conf

➞

Show inline comments

 table filter {
     chain INPUT {
         # HTTP
         proto tcp dport 80 ACCEPT;
         # HTTPS
         proto tcp dport 443 ACCEPT;
 domain (ip ip6) {
     table filter {
         chain INPUT {
             # HTTP
             proto tcp dport 80 ACCEPT;
             # HTTPS
             proto tcp dport 443 ACCEPT;
+        }
+    }
+}

roles/xmpp_server/files/ferm_xmpp.conf

➞

Show inline comments

 table filter {
     chain INPUT {
         # XMPP client connections.
         proto tcp dport 5222 ACCEPT;
         proto tcp dport 5223 ACCEPT;
         # File proxying.
         proto tcp dport 5000 ACCEPT;
         # XMPP server connections.
         proto tcp dport 5269 ACCEPT;
 domain (ip ip6) {
     table filter {
         chain INPUT {
             # XMPP client connections.
             proto tcp dport 5222 ACCEPT;
             proto tcp dport 5223 ACCEPT;
             # File proxying.
             proto tcp dport 5000 ACCEPT;
             # XMPP server connections.
             proto tcp dport 5269 ACCEPT;
+        }
+    }
+}
@@ \ No newline at end of file @@
+}

0 comments (0 inline, 0 general)