From e9e058fb2b1d4743b5c2994745957d66a78fd2a5 Mon Sep 17 00:00:00 2001 From: Henry Wang Date: Mon, 21 Oct 2019 12:14:31 +0800 Subject: [PATCH] ststs --- .DS_Store | Bin 0 -> 6148 bytes ...1forcmdeployment.platform9.puppet.net.yaml | 938 ++++++++++++++++++ manifests/site.pp | 9 - site-modules/.DS_Store | Bin 0 -> 6148 bytes site-modules/profile/.DS_Store | Bin 0 -> 6148 bytes site-modules/profile/manifests/.DS_Store | Bin 0 -> 6148 bytes site-modules/profile/manifests/base.pp | 5 - site-modules/profile/manifests/example.pp | 3 - site-modules/profile/manifests/firewall.pp | 36 + .../profile/manifests/firewall/app_rules.pp | 37 + .../profile/manifests/firewall/finish.pp | 41 + .../profile/manifests/firewall/start.pp | 60 ++ .../profile/manifests/firewall/stop.pp | 12 + 13 files changed, 1124 insertions(+), 17 deletions(-) create mode 100644 .DS_Store create mode 100644 data/nodes/linuxagent1forcmdeployment.platform9.puppet.net.yaml create mode 100644 site-modules/.DS_Store create mode 100644 site-modules/profile/.DS_Store create mode 100644 site-modules/profile/manifests/.DS_Store delete mode 100644 site-modules/profile/manifests/base.pp delete mode 100644 site-modules/profile/manifests/example.pp create mode 100644 site-modules/profile/manifests/firewall.pp create mode 100644 site-modules/profile/manifests/firewall/app_rules.pp create mode 100644 site-modules/profile/manifests/firewall/finish.pp create mode 100644 site-modules/profile/manifests/firewall/start.pp create mode 100644 site-modules/profile/manifests/firewall/stop.pp diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..7df7881a6d6f33293963952cc6ba9fc958868e58 GIT binary patch literal 6148 zcmeHKyH3L}6g{SupoO6uuw`VS5;H;y&mr2DKE4Eejum_!vHh4}f!R z4~+{F6GG_T$Uc7D!lYl)lCAibb)vCjba91qB)CLx z$y*y#0af6yDIni&6UXSH!|!(C`#s5v{!L!ouwR11KGV*JHI^7GFhGh2q=DZ{;MYQi z2_7-R6a`CTTYo?seOn(^`DQcVH*rU9Ms`Zh6Z0|hfb$%1R&k0G?kQm`>LCfd-vjRk zM@+f05r&*+#y!odjFmKCG;x7B?)hZ&9+H_O3pj59r@@$*;E*bx5!;+|P-WB(0>&!W z(&xTMoM&lGwb#IVgWeeqGRu%50zWr0)V{baii^(nh8QazVp#uKBu1O3~ zQw3B3RbWv8i4PHzVC=DUXhR1xdj%lY*=&tv`CSlB(rOnA%8!=roiHTq7&{CNB + # SELINUXTYPE= can take one of these two values: + # targeted - Targeted processes are protected, + # mls - Multi Level Security protection. + SELINUXTYPE=<%= $type %> + +# CIS 1.6.1.6 L2 Ensure no unconfined daemons exist + +# CIS 6.1.1 L2 Audit system file permissions diff --git a/manifests/site.pp b/manifests/site.pp index d64a011..11663aa 100644 --- a/manifests/site.pp +++ b/manifests/site.pp @@ -29,12 +29,3 @@ node default { # Example: # class { 'my_class': } } - - - -node linuxagent1forcmdeployment.platform9.puppet.net { - include firewall - resources { 'firewall': - purge => true, - } -} diff --git a/site-modules/.DS_Store b/site-modules/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..05b8c548c5cec8c7a987e951c10d055d6d3c3fb2 GIT binary patch literal 6148 zcmeHKyH3O~5S)cboJ4aarAu0B8tZfv)b|7EcnK-GoKAu|9pA!N!t8@6$k0;2jwL z@`o)~^jep+^LGPhP4vs=u}2i}CrflFVyDwzEF4mub4&$Nfv*Z^?@cVV{$J64=>Ih)kqV>&e^deK z)|>T;FBi47c}=agg?2;x1Y<3ngOy^km0~_IYmi9ogaYk5|Xhc0;%2c*)aP+isiVafL&>C?sj*4 z_7vVb0J8jexB?ac=5$4T>M%CVtB>p?B8pE<9PqpQ zZPRU;)mOWwUw)Z!c9gN-ytPf&J~PXANlOJ%fm9$BNCi@X2?e50&d(?E8BPUKf&Z(3 z{vQfmu?F^z_UquF$9K)o6xBGly9BYsx(4=+%+SQCM5jtzF~sSNm#C|Oy`$41wlkj- zJ4@V9#CB)ASUIFR=9mhk0z(B(eYw#7zot*z|A(Ypr2?tIpHe_(tIcZ3Pm10;`Z(>i sg?>x_G1gi+hruC$3vI<02X#f~tgC^&qtO{RIx!Cds!Lib@EZzz151%2J^%m! literal 0 HcmV?d00001 diff --git a/site-modules/profile/manifests/.DS_Store b/site-modules/profile/manifests/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..d16078c15d110552cb87a1ca856be4731efe0d88 GIT binary patch literal 6148 zcmeHKJxc>Y5PhR54$`Ew+|o+0wmCvlSmzID{6biAArNiv@8nnNn-ArpR|k<9n0<3Q zAA9%Uc6R{CeE)b2%m6f0MNwl!bb8cv7QyF4u^R8VM@7A@-NQ(szc{7u-ryOp*x?C- z_g~j;O`j5TL%sYkp*0f!w%ToKw|SwDJYf2>9F7 z2^i3`iqcFSb4&)3fn?yD0o@-8Rk0219c}C2U@ZV~!f6xQdS%v}64(azj`UE(Q;D7` z(PD_FbG}4e8`wK~IwYD8iIu;a7qQh@zgRe=b<8mtNCu7>(B79a)AN7HUuLw)w~!o? zfn?ynG9Z)1YBA^6#o7AnJN2wB)H|w*#`S7YXdhhy_@Mj9g*n|{)Mi{8*gI+!owsyi OUIdJg9Fl<(Fz^YEZ7-$( literal 0 HcmV?d00001 diff --git a/site-modules/profile/manifests/base.pp b/site-modules/profile/manifests/base.pp deleted file mode 100644 index ae85e65..0000000 --- a/site-modules/profile/manifests/base.pp +++ /dev/null @@ -1,5 +0,0 @@ -class profile::base { - - #the base profile should include component modules that will be on all nodes - -} diff --git a/site-modules/profile/manifests/example.pp b/site-modules/profile/manifests/example.pp deleted file mode 100644 index 0b48c3a..0000000 --- a/site-modules/profile/manifests/example.pp +++ /dev/null @@ -1,3 +0,0 @@ -class profile::example { - -} diff --git a/site-modules/profile/manifests/firewall.pp b/site-modules/profile/manifests/firewall.pp new file mode 100644 index 0000000..99c580b --- /dev/null +++ b/site-modules/profile/manifests/firewall.pp @@ -0,0 +1,36 @@ +# == Class: profile::firewall +# +# Class to configure the firewall on various platforms +# +class profile::firewall ( + # Class parameters are populated from External(hiera)/Defaults/Fail + Boolean $enable = false, + String $module = 'firewall', +){ + if $facts['os']['family'] == 'RedHat' { + # firewalld - do not use this for new config + if $module == 'firewalld' { + if $enable { + class { 'firewalld': } + } + else { + class { 'firewalld': + service_ensure => 'stopped', + service_enable => false, + } + } + } + else { + # Use this for new config + if $enable { + class { 'profile::firewall::start': } + -> class { 'profile::firewall::app_rules': } + -> class { 'profile::firewall::finish': } + } + else { + class { 'profile::firewall::stop': } + } + } + } + +} diff --git a/site-modules/profile/manifests/firewall/app_rules.pp b/site-modules/profile/manifests/firewall/app_rules.pp new file mode 100644 index 0000000..1ad8a3e --- /dev/null +++ b/site-modules/profile/manifests/firewall/app_rules.pp @@ -0,0 +1,37 @@ +# profile::firewall::app_rules +class profile::firewall::app_rules { + + # Custom Application Firewall rules found in Hiera + + ['inbound','outbound'].each | $direction | { + $firewalls= lookup("profile::firewall::${direction}", Data, 'deep', {}) + $firewalls.each | $name, $rule | { + $label = upcase( $direction ) + $chain = $direction ? { + 'inbound' => 'INPUT', + 'outbound' => 'OUTPUT', + default => '', + } + if has_key( $rule, 'jump') { + $default = {} + } else { + $default = { action => 'accept' } + } + if $rule['destination'] { + if is_array( $rule['destination'] ){ + $destinations = $rule['destination'] + } else { + $destinations = [ $rule['destination'] ] + } + $destinations.each | $dest | { + $mod_rule = $rule + { 'destination' => $dest } + create_resources( firewall, { "${name} ${label} ${dest}" => $mod_rule }, $default + { proto => 'tcp', chain => $chain } ) + } + } + else { + create_resources( firewall, { "${name} ${label}" => $rule }, $default + { proto => 'tcp', chain => $chain } ) + } + } + } + +} diff --git a/site-modules/profile/manifests/firewall/finish.pp b/site-modules/profile/manifests/firewall/finish.pp new file mode 100644 index 0000000..9c140e4 --- /dev/null +++ b/site-modules/profile/manifests/firewall/finish.pp @@ -0,0 +1,41 @@ +# == Class: profile::firewall::finish +# +# Post actions for firewall management. +# +class profile::firewall::finish { + + + ['INPUT','OUTPUT'].each | $chain | { + + # Drop the known noise from hitting the log + ['255.255.255.255',ip_address(ip_broadcast("${::network}/${::netmask}"))].each | $dest | { + firewall { "990 Broadcasts for $dest for ${chain}": + destination => $dest, + proto => 'all', + action => 'drop', + chain => $chain, + } + } + + # Log whatever hasn't been dealt with already + firewall { "998 Logging for ${chain}": + jump => 'LOG', + proto => 'all', + chain => $chain, + } + + # Drop everything else + firewall { "999 drop all for ${chain}": + proto => 'all', + action => 'drop', + chain => $chain, + } + firewall { "999 drop all for ${chain} for IPv6": + proto => 'all', + action => 'drop', + chain => $chain, + provider => 'ip6tables', + } + } + +} diff --git a/site-modules/profile/manifests/firewall/start.pp b/site-modules/profile/manifests/firewall/start.pp new file mode 100644 index 0000000..e18aaa1 --- /dev/null +++ b/site-modules/profile/manifests/firewall/start.pp @@ -0,0 +1,60 @@ +# == Class: profile::firewall::start +# +# Pre actions for firewall management. +# +class profile::firewall::start { + + class { 'firewall': } + + # Purge any unmanaged firewall rules + resources { 'firewall': + purge => true, + } + #resources { 'firewallchain': + #purge => true, + #} + + #Set up the chains (if specified) + $chains = lookup('profile::firewall::chains', Data , 'deep', {}) + create_resources( firewallchain, $chains, { policy => 'drop', before => undef, ensure => 'present' } ) + + + # Default pre rules + ['INPUT','OUTPUT'].each | $chain | { + firewall { "000 accept all icmp ${chain}": + proto => 'icmp', + action => 'accept', + chain => $chain, + } + if( $chain == 'INPUT' ){ + firewall { "001 accept all to lo interface ${chain}": + proto => 'all', + iniface => 'lo', + action => 'accept', + chain => $chain, + } + firewall { "002 reject local traffic not on loopback interface ${chain}": + iniface => '! lo', + proto => 'all', + destination => '127.0.0.1/8', + action => 'reject', + chain => $chain, + } + } + if( $chain == 'OUTPUT' ){ + firewall { "001 accept all localhost sourced ${chain}": + proto => 'all', + source => '127.0.0.1/8', + action => 'accept', + chain => $chain, + } + } + firewall { "003 accept related established rules ${chain}": + proto => 'all', + state => ['RELATED', 'ESTABLISHED'], + action => 'accept', + chain => $chain, + } + } + +} diff --git a/site-modules/profile/manifests/firewall/stop.pp b/site-modules/profile/manifests/firewall/stop.pp new file mode 100644 index 0000000..b4f0055 --- /dev/null +++ b/site-modules/profile/manifests/firewall/stop.pp @@ -0,0 +1,12 @@ +# == Class: profile::firewall::stop +# +# Turn off all firewall management. +# +class profile::firewall::stop { + + class { 'firewall': + ensure => 'stopped', + enable => false, + } + +}