majic-ansible-roles Files · roles/common/templates/00-base.conf.j2

Files @ 1b05bae8e440

Branch filter:

Location: majic-ansible-roles/roles/common/templates/00-base.conf.j2

1b05bae8e440 1.4 KiB text/plain Show Annotation Show as Raw Download as Raw

branko

MAR-56: Added LDIF templates to docs for relevant roles. Added warning about freshclam/clamav service restart during initial install (need to be restarted). Switched some TLS truststore vars to use concerete values. Introduced option for specifying additional Nginx config options. Added docs for some params. Assmeble Duplicity include pattern when needed. Don't set passwords for existing system users. Fix permissions for database users to be more restrictive. Fixed a couple of default param definitions (mainly tls cert/key stuff). Updated URL for downloading Prosody LDAP plugin. Updated testsite configs.

table filter {
    chain INPUT {
        policy DROP;
        interface lo ACCEPT;
        # Make sure not to allow flooding via ICMP ping packages by sending them
        # to flood chain before state module kicks in.
        proto icmp icmp-type echo-request jump flood;
        mod state state (ESTABLISHED RELATED) ACCEPT;
        # For TCP packages we perform floods checks after state module took care
        # of established and related connections.
        proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
        # Accept some common incoming connections.
        proto icmp icmp-type echo-request ACCEPT;
        proto tcp dport 22 ACCEPT;
    }

    # The flood chain is used for controlling the rate of the incoming connections.
    chain flood {
        # Rate-limit the ping requests.
        proto icmp icmp-type echo-request {
            mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                hashlimit-mode srcip hashlimit-name icmp RETURN;
            DROP;
        }
        # Rate-limit the TCP connections.
        proto tcp tcp-flags (FIN SYN RST ACK) SYN {
            mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                hashlimit-mode srcip hashlimit-name icmp RETURN;
            LOG;
            DROP;
        }
    }

}