diff options
| author | Micah Anderson <micah@leap.se> | 2013-08-20 19:45:56 -0400 |
|---|---|---|
| committer | Micah Anderson <micah@leap.se> | 2013-08-22 09:43:20 -0400 |
| commit | 3cdebf3ebe73cb2859dc852dcc73a8ee2d60e976 (patch) | |
| tree | 12ff5dd71a6fab4977abd5587cc949bca2493183 /puppet/modules/site_shorewall/manifests/sshd.pp | |
| parent | 5229fc7ffc3e804b788b3d25042514806f9a4e9b (diff) | |
install a preliminary firewall that blocks everything, except ssh for the cases when shorewall doesn't properly come up, ensuring that it fails safe (#3339)
Change-Id: Id4f0bf6cf25f420aa2ad67635b37ae95f54e3d38
Diffstat (limited to 'puppet/modules/site_shorewall/manifests/sshd.pp')
| -rw-r--r-- | puppet/modules/site_shorewall/manifests/sshd.pp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp index a8e09e42..88b4102c 100644 --- a/puppet/modules/site_shorewall/manifests/sshd.pp +++ b/puppet/modules/site_shorewall/manifests/sshd.pp @@ -21,4 +21,10 @@ class site_shorewall::sshd { action => 'leap_sshd(ACCEPT)', order => 200; } + + # setup a routestopped rule to allow ssh when shorewall is stopped + shorewall::routestopped { $site_config::params::interface: + options => "- tcp ${ssh_port}" + } + } |