Matanya has uploaded a new change for review.
https://gerrit.wikimedia.org/r/117698
Change subject: ldap: replace iptables with ferm rule
......................................................................
ldap: replace iptables with ferm rule
Change-Id: Ieee75b4f65c20d240a6398babbe72f88376803d0
---
M modules/ldap/manifests/server.pp
1 file changed, 7 insertions(+), 42 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/98/117698/1
diff --git a/modules/ldap/manifests/server.pp b/modules/ldap/manifests/server.pp
index f524f1d..c64d36e 100644
--- a/modules/ldap/manifests/server.pp
+++ b/modules/ldap/manifests/server.pp
@@ -1,50 +1,15 @@
# ldap
#
-class ldap::server::iptables-purges {
+class ldap::server::firewall {
- require 'iptables::tables'
+ ferm::rule { 'ldap_server_corp':
+ rule => 'saddr (216.38.130.188) proto tcp dport (ldap) ACCEPT;',
+ }
- # The deny_all rule must always be purged, otherwise ACCEPTs can be placed
below it
- iptables_purge_service{ 'ldap_deny_all': service => 'ldap' }
- iptables_purge_service{ 'ldaps_deny_all': service => 'ldaps' }
-
- # When removing or modifying a rule, place the old rule here, otherwise it
won't
- # be purged, and will stay in the iptables forever
-
-}
-
-class ldap::server::iptables-accepts {
-
- require 'ldap::server::iptables-purges'
-
- # Remember to place modified or removed rules into purges!
- iptables_add_service{ 'ldap_server_corp': service => 'ldap', source =>
'216.38.130.188', jump => 'ACCEPT' }
- iptables_add_service{ 'ldaps_server_corp': service => 'ldaps', source =>
'216.38.130.188', jump => 'ACCEPT' }
- iptables_add_service{ 'ldaps_server_neon': service => 'ldaps', source =>
'208.80.154.14', jump => 'ACCEPT' }
-
-}
-
-class ldap::server::iptables-drops {
-
- require 'ldap::server::iptables-accepts'
-
- iptables_add_service{ 'ldap_server_deny_all': service => 'ldap', jump =>
'DROP' }
- iptables_add_service{ 'ldaps_server_deny_all': service => 'ldaps', jump =>
'DROP' }
-
-}
-
-class ldap::server::iptables {
-
- # We use the following requirement chain:
- # iptables -> iptables::drops -> iptables::accepts -> iptables::purges
- #
- # This ensures proper ordering of the rules
- require 'ldap::server::iptables-drops'
-
- # This exec should always occur last in the requirement chain.
- iptables_add_exec{ 'ldap_server': service => 'ldap_server' }
-
+ ferm::rule { 'ldap_server_corp_neon':
+ rule => 'saddr (216.38.130.188 208.80.154.14) proto tcp dport (ldaps)
ACCEPT;',
+ }
}
class ldap::server( $certificate_location, $certificate, $ca_name, $cert_pass,
$base_dn, $proxyagent, $proxyagent_pass, $server_bind_ips, $initial_password,
$first_master=false ) {
--
To view, visit https://gerrit.wikimedia.org/r/117698
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ieee75b4f65c20d240a6398babbe72f88376803d0
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Matanya <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
