Infrastructure/ansible
3
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Reorg buildvm/releng playbooks to use base and not duplicate parts of it.

Browse source
This commit is contained in:
Kevin Fenzi 2013-08-27 16:32:55 +00:00
parent 5875104df3
commit 31b3c1be15
13 changed files with 12 additions and 216 deletions
Download patch file Download diff file Expand all files Collapse all files

92
files/iptables/kojibuilder
View file

@ -1,92 +0,0 @@
# {{ ansible_managed }}
*filter
:INPUT DROP []
:FORWARD DROP []
:OUTPUT DROP []
# loopback allowed
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j ACCEPT
-A OUTPUT -d 127.0.0.0/8 -j ACCEPT
# Accept ping and traceroute (needs icmp)
-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# kojipkgs
-A OUTPUT -p tcp -m tcp -d 10.5.125.36 --dport 80 -j ACCEPT
#koji.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.125.63 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.125.63 --dport 443 -j ACCEPT
#arm.koji.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.124.138 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.124.138 --dport 443 -j ACCEPT
# DNS
-A OUTPUT -p udp -m udp -d 10.5.126.21 --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp -d 10.5.126.22 --dport 53 -j ACCEPT
# bastion smtp
-A OUTPUT -p tcp -m tcp -d 10.5.126.12 --dport 25 -j ACCEPT
# infra.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.126.23 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.126.23 --dport 443 -j ACCEPT
# rsyslog out to log02
-A OUTPUT -p tcp -m tcp -d 10.5.126.29 --dport 514 -j ACCEPT
# SSH
-A INPUT -p tcp -m tcp -s 10.5.0.0/16 --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.0.0/16 --sport 22 -j ACCEPT
# git to pkgs
-A OUTPUT -m tcp -p tcp --dport 9418 -d 10.5.125.44 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 9418 -d 10.5.125.44 -j ACCEPT
# http to pull sources from pkgs lookaside
-A OUTPUT -m tcp -p tcp --dport 80 -d 10.5.125.44 -j ACCEPT
# git to fedorahosted
-A OUTPUT -m tcp -p tcp --dport 9418 -d 66.135.62.191 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 9418 -d 66.135.62.191 -j ACCEPT
#nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but
# kinda necessary
-A INPUT -m tcp -p tcp -s 10.5.88.36 -j ACCEPT
-A OUTPUT -m tcp -p tcp -d 10.5.88.36 -j ACCEPT
-A INPUT -m udp -p udp -s 10.5.88.36 -j ACCEPT
-A OUTPUT -m udp -p udp -d 10.5.88.36 -j ACCEPT
# ntp
-A OUTPUT -m udp -p udp --dport 123 -d 66.187.233.4 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 123 -d 192.43.244.18 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 123 -d 128.118.25.5 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 123 -d 204.152.184.72 -j ACCEPT
# dhcp
-A OUTPUT -m udp -p udp --dport 67 -d 10.5.126.41 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
{% endfor %}
# if there are custom rules - put them in as-is
{% for rule in custom_rules %}
{{ rule }}
{% endfor %}
COMMIT

83
files/iptables/releng
View file

@ -1,83 +0,0 @@
# {{ ansible_managed }}
#
# NOTE: Chaging this template updates iptables on all releng hosts :)
# Please check with sysadmin-main before pushing out an update here.
#
*nat
:PREROUTING ACCEPT []
:POSTROUTING ACCEPT []
:OUTPUT ACCEPT []
COMMIT
*raw
:PREROUTING ACCEPT []
:OUTPUT ACCEPT []
COMMIT
*filter
:INPUT DROP []
:FORWARD ACCEPT []
:OUTPUT ACCEPT []
# loopback allowed
-A INPUT -i lo -j ACCEPT
# Accept ping and traceroute (needs icmp)
-A INPUT -p icmp -j ACCEPT
# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Overwrite any global rules
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp -s 192.168.1.10 --dport 5666 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp -s 209.132.181.102 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 209.132.181.35 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5666 -j ACCEPT
# SSH
# ssh block against uni in .cz where problem(s) have been cited
# added by skvidal on jan 24 2011 - as per request from spot
-A INPUT -p tcp -m tcp -s 147.251.0.0/16 --dport 22 -j REJECT
# matches last rule for a service we want blocked
-A INPUT -p tcp -m tcp -s 192.168.100.0/24 --dport 22 -j REJECT --reject-with tcp-reset
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
# Allow all netapp traffic
-A INPUT -p udp -m udp -s 10.5.88.36 -j ACCEPT
-A INPUT -p tcp -m tcp -s 10.5.88.36 -j ACCEPT
# Bacula Backups backup03
-A INPUT -p tcp -m tcp -s 10.5.126.161 --dport 9102 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.1.64 --dport 9102 -j ACCEPT
# Custom Services
# Services TCP
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
# Services UDP
# more services we use - ports for random services and TG listeners.
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
{% endfor %}
# if there are custom rules - put them in as-is
{% for rule in custom_rules %}
{{ rule }}
{% endfor %}
# Extra protection for 192.168.100.x vpn hosts.
-A INPUT -s 192.168.100.0/24 -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT