Saltstack Official UFW Formula
Du kan inte välja fler än 25 ämnen Ämnen måste starta med en bokstav eller siffra, kan innehålla bindestreck ('-') och vara max 35 tecken långa.

164 lines
3.9KB

  1. # UFW management module
  2. {%- set ufw = pillar.get('ufw', {}) %}
  3. {%- if ufw.get('enabled', False) %}
  4. {% from "ufw/map.jinja" import ufwmap with context %}
  5. {% set default_template = ufw.get('default_template', 'salt://ufw/templates/default.jinja') -%}
  6. {% set sysctl_template = ufw.get('sysctl_template', 'salt://ufw/templates/sysctl.jinja') -%}
  7. {% set settings_cfg = ufw.get('settings', {}) -%}
  8. {% set loglevel = settings_cfg.get('loglevel', 'low') -%}
  9. ufw:
  10. pkg.installed:
  11. - name: {{ ufwmap.pkg }}
  12. service.running:
  13. - enable: True
  14. - watch:
  15. - file: /etc/default/ufw
  16. - file: /etc/ufw/sysctl.conf
  17. /etc/default/ufw:
  18. file.managed:
  19. - template: jinja
  20. - user: root
  21. - group: root
  22. - mode: 644
  23. - source: {{ default_template }}
  24. /etc/ufw/sysctl.conf:
  25. file.managed:
  26. - template: jinja
  27. - user: root
  28. - group: root
  29. - mode: 644
  30. - source: {{ sysctl_template }}
  31. /etc/ufw/applications.d:
  32. file.recurse:
  33. - user: root
  34. - group: root
  35. - file_mode: 644
  36. - clean: False
  37. - source: salt://ufw/files/applications.d
  38. # services
  39. {%- for service_name, service_details in ufw.get('services', {}).items() %}
  40. {%- for from_addr in service_details.get('from_addr', [None]) %}
  41. {%- set protocol = service_details.get('protocol', None) %}
  42. {%- set from_port = service_details.get('from_port', None) %}
  43. {%- set to_addr = service_details.get('to_addr', None) %}
  44. {%- set comment = service_details.get('comment', None) %}
  45. ufw-svc-{{service_name}}-{{from_addr}}:
  46. ufw.allowed:
  47. {%- if protocol != None %}
  48. - protocol: {{protocol}}
  49. {%- endif %}
  50. {%- if from_addr != None %}
  51. - from_addr: {{from_addr}}
  52. {%- endif %}
  53. {%- if from_port != None %}
  54. - from_port: "{{from_port}}"
  55. {%- endif %}
  56. {%- if to_addr != None %}
  57. - to_addr: {{to_addr}}
  58. {%- endif %}
  59. {%- if comment != None %}
  60. - comment: '"{{comment}}"'
  61. {%- endif %}
  62. - to_port: "{{service_name}}"
  63. - require:
  64. - pkg: ufw
  65. - listen_in:
  66. - cmd: reload-ufw
  67. {%- endfor %}
  68. {%- endfor %}
  69. # Applications
  70. {%- for app_name, app_details in ufw.get('applications', {}).items() %}
  71. {%- for from_addr in app_details.get('from_addr', [None]) %}
  72. {%- set to_addr = app_details.get('to_addr', None) %}
  73. {%- set comment = app_details.get('comment', None) %}
  74. {%- if from_addr != None%}
  75. ufw-app-{{app_name}}-{{from_addr}}:
  76. {%- else %}
  77. ufw-app-{{app_name}}:
  78. {%- endif %}
  79. ufw.allowed:
  80. - app: '"{{app_name}}"'
  81. {%- if from_addr != None %}
  82. - from_addr: {{from_addr}}
  83. {%- endif %}
  84. {%- if to_addr != None %}
  85. - to_addr: {{to_addr}}
  86. {%- endif %}
  87. {%- if comment != None %}
  88. - comment: '"{{comment}}"'
  89. {%- endif %}
  90. - require:
  91. - pkg: ufw
  92. - listen_in:
  93. - cmd: reload-ufw
  94. {%- endfor %}
  95. {%- endfor %}
  96. # Interfaces
  97. {%- for interface_name, interface_details in ufw.get('interfaces', {}).items() %}
  98. {%- set comment = interface_details.get('comment', None) %}
  99. ufw-interface-{{interface_name}}:
  100. ufw.allowed:
  101. - interface: {{interface_name}}
  102. {%- if comment != None %}
  103. - comment: '"{{comment}}"'
  104. {%- endif %}
  105. - require:
  106. - pkg: ufw
  107. - listen_in:
  108. - cmd: reload-ufw
  109. {%- endfor %}
  110. # Open
  111. {%- for open_addr, open_details in ufw.get('open', {}).items() %}
  112. {%- set comment = open_details.get('comment', None) %}
  113. ufw-open-{{open_addr}}:
  114. ufw.allowed:
  115. - from_addr: {{open_addr}}
  116. {%- if comment != None %}
  117. - comment: '"{{comment}}"'
  118. {%- endif %}
  119. - require:
  120. - pkg: ufw
  121. - listen_in:
  122. - cmd: reload-ufw
  123. {%- endfor %}
  124. enable-ufw:
  125. ufw.enabled:
  126. - require:
  127. - pkg: ufw
  128. reload-ufw:
  129. cmd.wait:
  130. - name: ufw reload
  131. set-logging:
  132. cmd.run:
  133. - name: ufw logging {{ loglevel }}
  134. - unless: "grep 'LOGLEVEL={{ loglevel }}' /etc/ufw/ufw.conf"
  135. {% else %}
  136. #ufw:
  137. #ufw:
  138. #- disabled
  139. {% endif %}