From 3cdebf3ebe73cb2859dc852dcc73a8ee2d60e976 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 20 Aug 2013 19:45:56 -0400 Subject: install a preliminary firewall that blocks everything, except ssh for the cases when shorewall doesn't properly come up, ensuring that it fails safe (#3339) Change-Id: Id4f0bf6cf25f420aa2ad67635b37ae95f54e3d38 --- .../modules/site_shorewall/manifests/defaults.pp | 28 ++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests/defaults.pp') diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp index c62c9307..35e47982 100644 --- a/puppet/modules/site_shorewall/manifests/defaults.pp +++ b/puppet/modules/site_shorewall/manifests/defaults.pp @@ -1,4 +1,5 @@ class site_shorewall::defaults { + include shorewall include site_config::params @@ -18,8 +19,6 @@ class site_shorewall::defaults { options => 'tcpflags,blacklist,nosmurfs'; } - shorewall::routestopped { $site_config::params::interface: } - shorewall::policy { 'fw-to-all': sourcezone => 'fw', @@ -42,5 +41,30 @@ class site_shorewall::defaults { order => 200; } + package { 'shorewall-init': + ensure => installed + } + + augeas { + # stop instead of clear firewall on shutdown + 'shorewall_SAFESTOP': + changes => 'set /files/etc/shorewall/shorewall.conf/SAFESTOP Yes', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + # require that the interface exist + 'shorewall_REQUIRE_INTERFACE': + changes => 'set /files/etc/shorewall/shorewall.conf/REQUIRE_INTERFACE Yes', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + # configure shorewall-init + 'shorewall-init': + changes => 'set /files/etc/default/shorewall-init/PRODUCTS shorewall', + lens => 'Shellvars.lns', + incl => '/etc/default/shorewall-init', + require => [ Package['shorewall-init'], Service['shorewall'] ] + } + include site_shorewall::sshd } -- cgit v1.2.3 From 9544d1a4c8e3dfa11ba611b296a3e47edde0e67f Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 3 Sep 2013 14:47:09 -0400 Subject: make sure that the shorewall package is installed before trying to change its configuration file (#3701) Change-Id: Ib2dad30d53e5bf7539762eb3683430b10eb875ed --- puppet/modules/site_shorewall/manifests/defaults.pp | 2 ++ 1 file changed, 2 insertions(+) (limited to 'puppet/modules/site_shorewall/manifests/defaults.pp') diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp index 35e47982..6a40d501 100644 --- a/puppet/modules/site_shorewall/manifests/defaults.pp +++ b/puppet/modules/site_shorewall/manifests/defaults.pp @@ -51,12 +51,14 @@ class site_shorewall::defaults { changes => 'set /files/etc/shorewall/shorewall.conf/SAFESTOP Yes', lens => 'Shellvars.lns', incl => '/etc/shorewall/shorewall.conf', + require => Package['shorewall'], notify => Service[shorewall]; # require that the interface exist 'shorewall_REQUIRE_INTERFACE': changes => 'set /files/etc/shorewall/shorewall.conf/REQUIRE_INTERFACE Yes', lens => 'Shellvars.lns', incl => '/etc/shorewall/shorewall.conf', + require => Package['shorewall'], notify => Service[shorewall]; # configure shorewall-init 'shorewall-init': -- cgit v1.2.3 From 99df31cdd58ca60b90c0098b126903e2d8251128 Mon Sep 17 00:00:00 2001 From: varac Date: Wed, 16 Oct 2013 21:30:16 +0200 Subject: vagrant: support other providers besides virtualbox (Bug #4158), Part 2 took out the last remaining virtualbox references --- puppet/modules/site_shorewall/manifests/defaults.pp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests/defaults.pp') diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp index 6a40d501..8f56ac42 100644 --- a/puppet/modules/site_shorewall/manifests/defaults.pp +++ b/puppet/modules/site_shorewall/manifests/defaults.pp @@ -4,7 +4,9 @@ class site_shorewall::defaults { include site_config::params # be safe for development - #if ( $::virtual == 'virtualbox') { $shorewall_startup='0' } + # if ( $::site_config::params::environment == 'local' ) { + # $shorewall_startup='0' + # } # If you want logging: shorewall::params { -- cgit v1.2.3