Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

iptables: drop kojibuilder_iad2 in favor of kojibuilder, add tang access

Browse source 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2020-07-01 14:04:55 -07:00
parent d4b609e25a
commit 4857a1f032
5 changed files with 11 additions and 138 deletions
Download patch file Download diff file Expand all files Collapse all files

2
inventory/group_vars/buildvm_ppc64le
View file

@ -24,7 +24,7 @@ virt_install_command: "{{ virt_install_command_one_nic_unsafe }}"
# for systems that do not match the above - specify the same parameter in # for systems that do not match the above - specify the same parameter in
# the host_vars/$hostname file # the host_vars/$hostname file
host_group: kojibuilder_iad2 host_group: kojibuilder
fas_client_groups: sysadmin-releng fas_client_groups: sysadmin-releng
sudoers: "{{ private }}/files/sudo/00releng-sudoers" sudoers: "{{ private }}/files/sudo/00releng-sudoers"

2
inventory/group_vars/buildvm_s390x
View file

@ -16,7 +16,7 @@ virt_install_command: "{{ virt_install_command_s390x_one_nic }}"
ansible_ifcfg_blocklist: True ansible_ifcfg_blocklist: True
createrepo: False createrepo: False
host_group: kojibuilder_iad2 host_group: kojibuilder
fas_client_groups: sysadmin-releng fas_client_groups: sysadmin-releng
sudoers: "{{ private }}/files/sudo/00releng-sudoers" sudoers: "{{ private }}/files/sudo/00releng-sudoers"

2
inventory/group_vars/buildvm_s390x_stg
View file

@ -1,7 +1,7 @@
--- ---
ansible_ifcfg_blocklist: True ansible_ifcfg_blocklist: True
createrepo: False createrepo: False
host_group: kojibuilder_iad2 host_group: kojibuilder
fas_client_groups: sysadmin-releng fas_client_groups: sysadmin-releng
sudoers: "{{ private }}/files/sudo/00releng-sudoers" sudoers: "{{ private }}/files/sudo/00releng-sudoers"
ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-31-s390x ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-31-s390x

8
roles/base/templates/iptables/iptables.kojibuilder
View file

@ -32,6 +32,10 @@
-A OUTPUT -p tcp -m tcp -d 10.16.0.17 --dport 80 -j ACCEPT -A OUTPUT -p tcp -m tcp -d 10.16.0.17 --dport 80 -j ACCEPT
{% endif %} {% endif %}
# tang for buildhw
-A OUTPUT -p tcp -m tcp -d 10.3.163.37 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.38 --dport 80 -j ACCEPT
# DNS # DNS
-A OUTPUT -p udp -m udp -d 10.3.163.33 --dport 53 -j ACCEPT -A OUTPUT -p udp -m udp -d 10.3.163.33 --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.33 --dport 53 -j ACCEPT -A OUTPUT -p tcp -m tcp -d 10.3.163.33 --dport 53 -j ACCEPT
@ -102,6 +106,10 @@
# dhcp # dhcp
-A OUTPUT -m udp -p udp --dport 67 -d 10.3.163.10 -j ACCEPT -A OUTPUT -m udp -p udp --dport 67 -d 10.3.163.10 -j ACCEPT
# s390x builders ssh
-A INPUT -p tcp -m tcp -s 10.3.0.0/16 --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.0.0/16 --sport 22 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them # if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %} {% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT

135
roles/base/templates/iptables/iptables.kojibuilder_iad2
View file

@ -1,135 +0,0 @@
# {{ ansible_managed }}
*filter
:INPUT DROP []
:FORWARD DROP []
:OUTPUT DROP []
# loopback allowed
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -i virbr0 -j ACCEPT
-A OUTPUT -o virbr0 -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j ACCEPT
-A OUTPUT -d 127.0.0.0/8 -j ACCEPT
# Accept ping and traceroute (needs icmp)
-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
-A INPUT -s {{ ip }} -j DROP
{% endfor %}
{% endif %}
# kojipkgs
-A OUTPUT -p tcp -m tcp -d 10.3.169.106 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.107 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.106 --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.107 --dport 443 -j ACCEPT
{% if host in groups['buildvm_s390x'] %}
-A OUTPUT -p tcp -m tcp -d 10.16.0.17 --dport 80 -j ACCEPT
{% endif %}
#koji.fp.o
-A OUTPUT -p tcp -m tcp -d 10.3.169.104 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.104 --dport 443 -j ACCEPT
# compose-
-A OUTPUT -p tcp -m tcp -d 10.3.169.121 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.121 --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.122 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.122 --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.123 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.123 --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.124 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.169.124 --dport 443 -j ACCEPT
# DNS
-A OUTPUT -p udp -m udp -d 10.3.163.33 --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp -d 10.3.163.33 --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.34 --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.34 --dport 53 -j ACCEPT
# bastion smtp
-A OUTPUT -p tcp -m tcp -d 10.3.163.31 --dport 25 -j ACCEPT
# infra.fp.o
-A OUTPUT -p tcp -m tcp -d 10.3.163.35 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.35 --dport 443 -j ACCEPT
# rsyslog out to log01
-A OUTPUT -p tcp -m tcp -d 10.3.163.39 --dport 514 -j ACCEPT
# SSH
-A INPUT -p tcp -m tcp -s 10.3.0.0/16 --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.0.0/16 --sport 22 -j ACCEPT
{% if inventory_hostname.startswith (('buildvm-s390x-15', 'buildvm-s390x-16','buildvm-s390x-17')) %}
# Allow SSHFS binding to koji01
-A OUTPUT -p tcp -m tcp -d 10.3.169.104 --dport 22 -j ACCEPT
{% endif %}
# https git on pagure.io
-A OUTPUT -p tcp -m tcp -d 8.43.85.75 --dport 443 -j ACCEPT
# admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10)
-A OUTPUT -p tcp -m tcp -d 10.3.163.74 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.74 --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.75 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.75 --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.76 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.76 --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.77 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.77 --dport 443 -j ACCEPT
# for 2 facter auth
-A OUTPUT -p tcp -m tcp -d 10.3.163.69 --dport 8443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.70 --dport 8443 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.3.163.71 --dport 8443 -j ACCEPT
#nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but
# kinda necessary
-A INPUT -m tcp -p tcp -s 10.3.162.11 -j ACCEPT
-A OUTPUT -m tcp -p tcp -d 10.3.162.11 -j ACCEPT
-A INPUT -m udp -p udp -s 10.3.162.11 -j ACCEPT
-A OUTPUT -m udp -p udp -d 10.3.162.11 -j ACCEPT
-A INPUT -m tcp -p tcp -s 10.3.162.12 -j ACCEPT
-A OUTPUT -m tcp -p tcp -d 10.3.162.12 -j ACCEPT
-A INPUT -m udp -p udp -s 10.3.162.12 -j ACCEPT
-A OUTPUT -m udp -p udp -d 10.3.162.12 -j ACCEPT
-A INPUT -m tcp -p tcp -s 10.3.162.13 -j ACCEPT
-A OUTPUT -m tcp -p tcp -d 10.3.162.13 -j ACCEPT
-A INPUT -m udp -p udp -s 10.3.162.13 -j ACCEPT
-A OUTPUT -m udp -p udp -d 10.3.162.13 -j ACCEPT
-A INPUT -m tcp -p tcp -s 10.3.162.14 -j ACCEPT
-A OUTPUT -m tcp -p tcp -d 10.3.162.14 -j ACCEPT
-A INPUT -m udp -p udp -s 10.3.162.14 -j ACCEPT
-A OUTPUT -m udp -p udp -d 10.3.162.14 -j ACCEPT
# ntp
-A OUTPUT -m udp -p udp --dport 123 -d 10.3.163.31 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 123 -d 10.3.163.32 -j ACCEPT
# dhcp
-A OUTPUT -m udp -p udp --dport 67 -d 10.3.163.10 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
{% endfor %}
# if there are custom rules - put them in as-is
{% for rule in custom_rules %}
{{ rule }}
{% endfor %}
COMMIT