From 3cdebf3ebe73cb2859dc852dcc73a8ee2d60e976 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 20 Aug 2013 19:45:56 -0400
Subject: install a preliminary firewall that blocks everything, except ssh for
 the cases when shorewall doesn't properly come up, ensuring that it fails
 safe (#3339)

Change-Id: Id4f0bf6cf25f420aa2ad67635b37ae95f54e3d38
---
 puppet/modules/site_shorewall/manifests/sshd.pp | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'puppet/modules/site_shorewall/manifests/sshd.pp')

diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp
index a8e09e42..88b4102c 100644
--- a/puppet/modules/site_shorewall/manifests/sshd.pp
+++ b/puppet/modules/site_shorewall/manifests/sshd.pp
@@ -21,4 +21,10 @@ class site_shorewall::sshd {
         action      => 'leap_sshd(ACCEPT)',
         order       => 200;
   }
+
+  # setup a routestopped rule to allow ssh when shorewall is stopped
+  shorewall::routestopped { $site_config::params::interface:
+    options => "-   tcp   ${ssh_port}"
+  }
+
 }
-- 
cgit v1.2.3