diff options
author | varac <varacanero@zeromail.org> | 2013-02-06 18:11:21 +0100 |
---|---|---|
committer | varac <varacanero@zeromail.org> | 2013-02-06 23:23:21 +0100 |
commit | ab25692d3b8aaf3e71ec3546d1ea9d85f26f7b63 (patch) | |
tree | 327a23c7fe726f57517fec594e08b0d5b811656d /puppet/modules/site_shorewall/manifests/sshd.pp | |
parent | 97c5451b0f8b63b4884a9560c0a796f931d059e3 (diff) |
Restructuring site_shorewall
site_shorewall::defaults can be used on every host, it configures
a basic firewall, which blocks everything from outside except
ping + ssh, and allows outgoing traffic for http, git, dns.
Diffstat (limited to 'puppet/modules/site_shorewall/manifests/sshd.pp')
-rw-r--r-- | puppet/modules/site_shorewall/manifests/sshd.pp | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp new file mode 100644 index 00000000..2cf4fd56 --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/sshd.pp @@ -0,0 +1,23 @@ +class site_shorewall::sshd { + + $ssh_config = hiera('ssh') + $ssh_port = $ssh_config['port'] + + include shorewall + + # define macro for incoming sshd + file { '/etc/shorewall/macro.leap_sshd': + content => "PARAM - - tcp $ssh_port", + notify => Service['shorewall'] + } + + + shorewall::rule { + # outside to server + 'net2fw-ssh': + source => 'net', + destination => '$FW', + action => 'leap_sshd(ACCEPT)', + order => 200; + } +} |