167 lines
4.0 KiB
Ruby
167 lines
4.0 KiB
Ruby
|
# frozen_string_literal: true
|
||
|
|
|
||
|
|
control 'firewalld `map.jinja` YAML dump' do
|
||
|
|
title 'should contain the lines'
|
||
|
|
|
||
|
|
yaml_dump = "---\n"
|
||
|
|
yaml_dump += <<~YAML_DUMP.chomp
|
||
|
|
AutomaticHelpers: system
|
||
|
|
FirewallBackend: nftables
|
||
|
|
FlushAllOnReload: 'yes'
|
||
|
|
IndividualCalls: 'no'
|
||
|
|
LogDenied: 'off'
|
||
|
|
RFC3964_IPv4: 'yes'
|
||
|
|
backend:
|
||
|
|
manage: true
|
||
|
|
pkg: nftables
|
||
|
|
config: /etc/firewalld.conf
|
||
|
|
default_zone: public
|
||
|
|
direct:
|
||
|
|
chain:
|
||
|
|
MYCHAIN:
|
||
|
|
ipv: ipv4
|
||
|
|
table: raw
|
||
|
|
rule:
|
||
|
|
INTERNETACCESS:
|
||
|
|
ipv: ipv4
|
||
|
|
table: filter
|
||
|
|
chain: FORWARD
|
||
|
|
priority: '0'
|
||
|
|
args: -i iintern -o iextern -s 192.168.1.0/24 -m conntrack --ctstate NEW,RELATED,ESTABLISHED
|
||
|
|
-j ACCEPT
|
||
|
|
passthrough:
|
||
|
|
MYPASSTHROUGH:
|
||
|
|
ipv: ipv4
|
||
|
|
args: -t raw -A MYCHAIN -j DROP
|
||
|
|
enabled: true
|
||
|
|
ipset:
|
||
|
|
manage: true
|
||
|
|
pkg: ipset
|
||
|
|
ipsets:
|
||
|
|
fail2ban-ssh:
|
||
|
|
short: fail2ban-ssh
|
||
|
|
description: fail2ban-ssh ipset
|
||
|
|
type: hash:ip
|
||
|
|
options:
|
||
|
|
maxelem:
|
||
|
|
- 65536
|
||
|
|
timeout:
|
||
|
|
- 300
|
||
|
|
hashsize:
|
||
|
|
- 1024
|
||
|
|
entries:
|
||
|
|
- 10.0.0.1
|
||
|
|
fail2ban-ssh-ipv6:
|
||
|
|
short: fail2ban-ssh-ipv6
|
||
|
|
description: fail2ban-ssh-ipv6 ipset
|
||
|
|
type: hash:ip
|
||
|
|
options:
|
||
|
|
family:
|
||
|
|
- inet6
|
||
|
|
maxelem:
|
||
|
|
- 65536
|
||
|
|
timeout:
|
||
|
|
- 300
|
||
|
|
hashsize:
|
||
|
|
- 1024
|
||
|
|
entries:
|
||
|
|
- 2a01::1
|
||
|
|
package: firewalld
|
||
|
|
service: firewalld
|
||
|
|
services:
|
||
|
|
sshcustom:
|
||
|
|
short: sshcustom
|
||
|
|
description: SSH on port 3232 and 5252. Secure Shell (SSH) is a protocol for logging
|
||
|
|
into and executing commands on remote machines. It provides secure encrypted
|
||
|
|
communications. If you plan on accessing your machine remotely via SSH over
|
||
|
|
a firewalled interface, enable this option. You need the openssh-server package
|
||
|
|
installed for this option to be useful.
|
||
|
|
ports:
|
||
|
|
tcp:
|
||
|
|
- 3232
|
||
|
|
- 5252
|
||
|
|
modules:
|
||
|
|
- some_module_to_load
|
||
|
|
protocols:
|
||
|
|
- igmp
|
||
|
|
source_ports:
|
||
|
|
tcp:
|
||
|
|
- 21
|
||
|
|
destinations:
|
||
|
|
ipv4:
|
||
|
|
- 224.0.0.251
|
||
|
|
- 224.0.0.252
|
||
|
|
ipv6:
|
||
|
|
- ff02::fb
|
||
|
|
- ff02::fc
|
||
|
|
zabbixcustom:
|
||
|
|
short: Zabbixcustom
|
||
|
|
description: zabbix custom rule
|
||
|
|
ports:
|
||
|
|
tcp:
|
||
|
|
- '10051'
|
||
|
|
salt-minion:
|
||
|
|
short: salt-minion
|
||
|
|
description: salt-minion
|
||
|
|
ports:
|
||
|
|
tcp:
|
||
|
|
- '8000'
|
||
|
|
zones:
|
||
|
|
public:
|
||
|
|
short: Public
|
||
|
|
description: For use in public areas. You do not trust the other computers on
|
||
|
|
networks to not harm your computer. Only selected incoming connections are accepted.
|
||
|
|
services:
|
||
|
|
- http
|
||
|
|
- https
|
||
|
|
- ssh
|
||
|
|
- salt-minion
|
||
|
|
other_services:
|
||
|
|
- zabbixcustom
|
||
|
|
protocols:
|
||
|
|
- igmp
|
||
|
|
rich_rules:
|
||
|
|
- family: ipv4
|
||
|
|
source:
|
||
|
|
address: 8.8.8.8/24
|
||
|
|
accept: true
|
||
|
|
- family: ipv4
|
||
|
|
ipset:
|
||
|
|
name: fail2ban-ssh
|
||
|
|
reject:
|
||
|
|
type: icmp-port-unreachable
|
||
|
|
ports:
|
||
|
|
- comment: zabbix-agent
|
||
|
|
port: 10050
|
||
|
|
protocol: tcp
|
||
|
|
- comment: bacula-client
|
||
|
|
port: 9102
|
||
|
|
protocol: tcp
|
||
|
|
- comment: vsftpd
|
||
|
|
port: 21
|
||
|
|
protocol: tcp
|
||
|
|
source_ports:
|
||
|
|
- comment: something
|
||
|
|
port: 2222
|
||
|
|
protocol: tcp
|
||
|
|
- comment: something_else
|
||
|
|
port: 4444
|
||
|
|
protocol: tcp
|
||
|
|
rich_public:
|
||
|
|
short: rich_public
|
||
|
|
description: Example
|
||
|
|
rich_rules:
|
||
|
|
ssh-csg:
|
||
|
|
accept: true
|
||
|
|
ipsets:
|
||
|
|
- fail2ban-ssh
|
||
|
|
- other-ipset
|
||
|
|
services:
|
||
|
|
- ssh
|
||
|
|
YAML_DUMP
|
||
|
|
|
||
|
|
describe file('/tmp/salt_yaml_dump.yaml') do
|
||
|
|
its('content') { should include yaml_dump }
|
||
|
|
end
|
||
|
|
end
|