leap_platform.git/puppet/modules/site_shorewall, branch 0.5.0

vagrant: support other providers besides virtualbox (Bug #4158), Part 2

2013-10-16T19:30:16+00:00

took out the last remaining virtualbox references

make sure that the shorewall package is installed before trying to change its configuration file (#3701)

2013-09-04T14:45:20+00:00

Change-Id: Ib2dad30d53e5bf7539762eb3683430b10eb875ed

postfix enable submission port using starttls, so the client can transition to the more restrictive TLS wrapper mode

2013-08-31T12:33:53+00:00

Change-Id: I2a1728788378d9a1b79155ddb9bb4b0464b16baa

Make TLS-required smtps (465) be port for sending SMTP. This is preferred over 25 because that is typically blocked, and we cannot force TLS on that port due to other MTAs not being configured for this century. We don't use submission (568) because that uses STARTTLS, and the STARTTLS banner can easily be stripped by an adversary. (#3604)

2013-08-29T20:15:24+00:00

. enable smtps (port 465) for client submission over TLS, and require that TLS is enabled
. add 465 to the allowed open ports in the firewall
. change the smtp-service.json to use 465 instead of 25

note: I did not use the 'use_smtps' parameter that is available in the postfix
class because it added some options that we do not want/need.

Change-Id: I0040eb2dff6008a1c830d59df9963eb83dc9ea02

install a preliminary firewall that blocks everything, except ssh for the cases when shorewall doesn't properly come up, ensuring that it fails safe (#3339)

2013-08-22T13:43:20+00:00

Change-Id: Id4f0bf6cf25f420aa2ad67635b37ae95f54e3d38

make site_shorewall::soledad use the hiera value for the soledad port

2013-08-01T10:04:47+00:00

Change-Id: I923f15de807f907d6246c3a83df1e59c39d4e920

Merge branch 'feature/soledad' into feature/leap_mx

2013-07-26T18:11:33+00:00

initial soledad configuration

2013-07-25T19:07:57+00:00

Change-Id: I19e91887c3f8e90764b4baef8c5e29e25658e190

shorewall rules for site_mx

2013-07-25T17:45:10+00:00

webapp should be available over http so a proper redirect can be done to https

2013-06-12T18:01:24+00:00

without this rule, one just gets a 'site is unavailable' result

Change-Id: I27b80a0044e9fe4e87e607412c8d0a089d4866a6