modules/ferm/manifests/init.pp

   1 class ferm {
   2         define rule($domain="ip", $chain="INPUT", $rule, $description="", $prio="00") {
   3                 file { "/etc/ferm/dsa.d/${prio}_${name}":
   4                         ensure  => present,
   5                         owner   => root,
   6                         group   => root,
   7                         mode    => 0600,
   8                         content => template("ferm/ferm-rule.erb"),
   9                 }
  10         }
  11
  12         package { ferm: ensure => installed }
  13
  14         file {
  15                 "/etc/ferm/dsa.d":
  16                         ensure => directory,
  17                         require => Package["ferm"];
  18                 "/etc/ferm/conf.d":
  19                         ensure => directory,
  20                         require => Package["ferm"];
  21                 "/etc/ferm/ferm.conf":
  22                         source  => "puppet:///ferm/ferm.conf",
  23                         require => Package["ferm"],
  24                         notify  => Exec["ferm restart"];
  25                 "/etc/ferm/conf.d/me.conf":
  26                         content => template("ferm/me.conf.erb"),
  27                         require => Package["ferm"],
  28                         notify  => Exec["ferm restart"];
  29         }
  30
  31         ferm::rule { "dsa-ssh":
  32                 description     => "Allow SSH from DSA",
  33                 rule            => 'proto tcp mod state state (NEW) dport (ssh) @subchain "ssh" { saddr ($SSH_SOURCES) ACCEPT; }'
  34         }
  35
  36         exec { "ferm restart":
  37                 path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
  38                 refreshonly => true,
  39         }
  40 }