From 71a350dacabfb9a48e74b135aa70af1f3aa4d102 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 1 Oct 2014 20:36:14 +0000 Subject: [PATCH] Lock down postgresql access to koji03/04. Nothing else should need it. --- inventory/host_vars/db-koji01.phx2.fedoraproject.org | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/inventory/host_vars/db-koji01.phx2.fedoraproject.org b/inventory/host_vars/db-koji01.phx2.fedoraproject.org index 450625e426..923ced6c71 100644 --- a/inventory/host_vars/db-koji01.phx2.fedoraproject.org +++ b/inventory/host_vars/db-koji01.phx2.fedoraproject.org @@ -24,8 +24,12 @@ host_backup_targets: ['/backups'] lvm_size: 300000 mem_size: 25165 num_cpus: 8 -tcp_ports: [ 5432, 443 ] fas_client_groups: sysadmin-dba,sysadmin-noc # kernel SHMMAX value kernel_shmmax: 68719476736 + +# +# Only allow postgresql access from the frontend node. +# +custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.5.125.59 --dport 5432 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.5.125.60 --dport 5432 -j ACCEPT' ]