From ab25692d3b8aaf3e71ec3546d1ea9d85f26f7b63 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 6 Feb 2013 18:11:21 +0100
Subject: Restructuring site_shorewall

site_shorewall::defaults can be used on every host, it configures
a basic firewall, which blocks everything from outside except
ping + ssh, and allows outgoing traffic for http, git, dns.
---
 puppet/modules/site_shorewall/manifests/sshd.pp | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 puppet/modules/site_shorewall/manifests/sshd.pp

(limited to 'puppet/modules/site_shorewall/manifests/sshd.pp')

diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp
new file mode 100644
index 00000000..2cf4fd56
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/sshd.pp
@@ -0,0 +1,23 @@
+class site_shorewall::sshd {
+
+  $ssh_config     = hiera('ssh')
+  $ssh_port       = $ssh_config['port']
+
+  include shorewall
+
+  # define macro for incoming sshd
+  file { '/etc/shorewall/macro.leap_sshd':
+    content => "PARAM   -       -       tcp    $ssh_port",
+    notify  => Service['shorewall']
+  }
+
+
+  shorewall::rule {
+      # outside to server
+      'net2fw-ssh':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_sshd(ACCEPT)',
+        order       => 200;
+  }
+}
-- 
cgit v1.2.3