diff options
author | Micah Anderson <micah@leap.se> | 2013-08-22 09:44:01 -0400 |
---|---|---|
committer | Micah Anderson <micah@leap.se> | 2013-08-22 09:44:01 -0400 |
commit | 86f00bc6c8f99c64804fe8c50dba0e297a2ab14d (patch) | |
tree | b3e290b0b4a0ecd334f8da43500d68188aa842e1 /puppet/modules/site_shorewall/manifests | |
parent | 613f7f12f4c907ea07e79e3e73da8f2b71d3436d (diff) | |
parent | 3cdebf3ebe73cb2859dc852dcc73a8ee2d60e976 (diff) |
Merge branch 'bug/3339' into develop
Diffstat (limited to 'puppet/modules/site_shorewall/manifests')
-rw-r--r-- | puppet/modules/site_shorewall/manifests/defaults.pp | 28 | ||||
-rw-r--r-- | puppet/modules/site_shorewall/manifests/sshd.pp | 6 |
2 files changed, 32 insertions, 2 deletions
diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp index c62c9307..35e47982 100644 --- a/puppet/modules/site_shorewall/manifests/defaults.pp +++ b/puppet/modules/site_shorewall/manifests/defaults.pp @@ -1,4 +1,5 @@ class site_shorewall::defaults { + include shorewall include site_config::params @@ -18,8 +19,6 @@ class site_shorewall::defaults { options => 'tcpflags,blacklist,nosmurfs'; } - shorewall::routestopped { $site_config::params::interface: } - shorewall::policy { 'fw-to-all': sourcezone => 'fw', @@ -42,5 +41,30 @@ class site_shorewall::defaults { order => 200; } + package { 'shorewall-init': + ensure => installed + } + + augeas { + # stop instead of clear firewall on shutdown + 'shorewall_SAFESTOP': + changes => 'set /files/etc/shorewall/shorewall.conf/SAFESTOP Yes', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + # require that the interface exist + 'shorewall_REQUIRE_INTERFACE': + changes => 'set /files/etc/shorewall/shorewall.conf/REQUIRE_INTERFACE Yes', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + # configure shorewall-init + 'shorewall-init': + changes => 'set /files/etc/default/shorewall-init/PRODUCTS shorewall', + lens => 'Shellvars.lns', + incl => '/etc/default/shorewall-init', + require => [ Package['shorewall-init'], Service['shorewall'] ] + } + include site_shorewall::sshd } diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp index a8e09e42..88b4102c 100644 --- a/puppet/modules/site_shorewall/manifests/sshd.pp +++ b/puppet/modules/site_shorewall/manifests/sshd.pp @@ -21,4 +21,10 @@ class site_shorewall::sshd { action => 'leap_sshd(ACCEPT)', order => 200; } + + # setup a routestopped rule to allow ssh when shorewall is stopped + shorewall::routestopped { $site_config::params::interface: + options => "- tcp ${ssh_port}" + } + } |