Merge branch 'master' of ssh://handel.debian.org/srv/puppet.debian.org/git/dsa-puppet

* 'master' of ssh://handel.debian.org/srv/puppet.debian.org/git/dsa-puppet: (24 commits)
  stop doubling up an entry
  add puppetmaster role
  be a little more liberal about throwing away MS traffic
  this should be empty for those hosters
  use the right list of hosts
  move inclusion of samhain to the end of the block, so it knows about all other classes included
  clean up samhain template by role instead of by hostname
  and even more carefully this time
  skip hosts without ip addresses in ldap
  bartok gets ferm
  add debian hosts to the list
  and recursors should allow localnets ...
  name new class correctly
  add bartok as recursor for manda
  add bartok as a recursor
  add local DNS recursor class
  /etc/ferm is now also (kind of, almost) under puppet control
  ferm.conf is now (kind of, almost) under puppet control
  and name them usefully
  use v4 for iptables and v6 for ip6tables
  ...

diff --git a/manifests/site.pp b/manifests/site.pp
index f57efd2daa95eeba2bb152474211f2fad8f76538..56f7d3b29dca58aeb0de17f3bca1bcf2abcc13a3 100644 (file)
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -31,7 +31,6 @@ node default {
     include ntp
 
     include motd
-    include samhain
 
     case $smartarraycontroller {
         "true":    { include debian-proliant }
@@ -74,10 +73,11 @@ node default {
     case $hostname {
         klecker,ravel,senfl,orff: { include named::secondary }
         geo1,geo2,geo3:           { include named::geodns }
+        bartok:                   { include named::recursor }
     }
 
     case $hostname {
-        logtest01,geo1,geo2,geo3: { include ferm }
+        logtest01,geo1,geo2,geo3,bartok: { include ferm }
     }
 
     case $brokenhosts {
@@ -89,4 +89,5 @@ node default {
     case $portforwarder_user_exists {
         "true":    { include portforwarder }
     }
+    include samhain
 }

diff --git a/modules/debian-org/misc/local.yaml b/modules/debian-org/misc/local.yaml
index 5335005116ac65e749b295d1ac8ea64048d75fe0..1de0136d392a1a2abc0c1a28ff3ceef1290b0a44 100644 (file)
--- a/modules/debian-org/misc/local.yaml
+++ b/modules/debian-org/misc/local.yaml
@@ -112,9 +112,12 @@ services:
     - draghi.debian.org
     - spohr.debian.org
   muninmaster: spohr.debian.org
-  nagiosmaster: tchaikovsky.debian.org
+  nagiosmaster:
+    - draghi.debian.org
+    - tchaikovsky.debian.org
   packagesmaster: powell.debian.org
   packagesqamaster: master.debian.org
+  puppetmaster: handel.debian.org
   qamaster: merkel.debian.org
   rtmaster: spohr.debian.org
 host_settings:

diff --git a/modules/ferm/files/ferm.conf b/modules/ferm/files/ferm.conf
index f761b01e82ed39cc3cbd2e4d7da1d57b0ef6404b..b5448b07a718827e7a004c2a89687054734678a9 100644 (file)
--- a/modules/ferm/files/ferm.conf
+++ b/modules/ferm/files/ferm.conf
@@ -54,6 +54,7 @@ domain (ip ip6) {
 
 domain (ip ip6) {
         chain INPUT {
+                proto (tcp udp) mod multiport destination-ports (135 137 138 139 445 1026 1027 1433) DROP;
                 jump log_or_drop;
         }
 }

diff --git a/modules/ferm/templates/defs.conf.erb b/modules/ferm/templates/defs.conf.erb
index 25cb39cafa1fcb8ef10fe7c36675a48d188784ee..31f1bb464027d8f67b3de0eb48686c465e3f1c23 100644 (file)
--- a/modules/ferm/templates/defs.conf.erb
+++ b/modules/ferm/templates/defs.conf.erb
@@ -105,6 +105,34 @@
 
 @def $HOST_DB = ($HOST_DB_V4 $HOST_DB_V6);
 
+@def $HOST_DEBIAN_V4 = (<%=
+  dbs = []
+  keyinfo.keys.sort.each do |node|
+      next unless keyinfo[node][0].has_key?('ipHostNumber')
+      keyinfo[node][0]['ipHostNumber'].each do |ip|
+         next if ip =~ /:/
+         dbs << ip
+      end
+  end
+
+  dbs.join(' ')
+%>);
+
+@def $HOST_DEBIAN_V6  = (<%=
+  dbs = []
+  keyinfo.keys.sort.each do |node|
+      next unless keyinfo[node][0].has_key?('ipHostNumber')
+      keyinfo[node][0]['ipHostNumber'].each do |ip|
+         next if ip =~ /\./
+         dbs << ip
+      end
+  end
+
+  dbs.join(' ')
+%>);
+
+@def $HOST_DEBIAN = ($HOST_DEBIAN_V4 $HOST_DEBIAN_V6);
+
 @def $sgran   = (91.103.132.24/29);
 @def $weasel  = ();
 @def $weasel  = ($weasel 86.59.118.144/28); # debian@sil
@@ -124,8 +152,8 @@
 @def $weasel6    = ($weasel6 2001:826:408:200::/56); # came
 @def $weasel6    = ($weasel6 2001:858:10f::/48); # anguilla
 @def $zobel6     = ();
-@def $zobel6     = ($zobel6 2001:6f8:1215::/48); baldur
-@def $zobel6     = ($zobel6 2001:6f8:928::/48); WS2 
-@def $zobel6     = ($zobel6 2a01:198:549::/48); WGS20
+@def $zobel6     = ($zobel6 2001:6f8:1215::/48); # baldur
+@def $zobel6     = ($zobel6 2001:6f8:928::/48); # WS2 
+@def $zobel6     = ($zobel6 2a01:198:549::/48); # WGS20
 @def $luca6      = ();
 @def $DSA_V6_IPS = ($sgran6 $weasel6 $zobel6 $luca6);

diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb
index f8a5755825b3a900bc89fcc21348840f58d45f8a..20edce92606a85061ec2f941b204e2985bbc3d31 100644 (file)
--- a/modules/ferm/templates/me.conf.erb
+++ b/modules/ferm/templates/me.conf.erb
@@ -9,7 +9,11 @@
 sshallowed = []
 
 case hostname
-  when 'logtest01', 'geo1', 'geo2', 'geo3' then sshallowed << [ '$DSA_IPS', '$HOST_NAGIOS_V4', '$HOST_DB_V4' ]
+  when 'logtest01', 'geo1', 'geo2', 'geo3', 'bartok' then sshallowed << [ '$DSA_IPS', '$HOST_NAGIOS_V4', '$HOST_DB_V4' ]
+end
+
+case hostname
+  when 'bartok' then sshallowed << '$HOST_DEBIAN_V4'
 end
 
 if sshallowed.length == 0
@@ -24,7 +28,11 @@ sshallowed.join(' ')
 sshallowed = []
 
 case hostname
-  when 'logtest01', 'geo1', 'geo2', 'geo3' then sshallowed << [ '$DSA_V6_IPS', '$HOST_NAGIOS_V6', '$HOST_DB_V6' ]
+  when 'logtest01', 'geo1', 'geo2', 'geo3', 'bartok' then sshallowed << [ '$DSA_V6_IPS', '$HOST_NAGIOS_V6', '$HOST_DB_V6' ]
+end
+
+case hostname
+  when 'bartok' then sshallowed << '$HOST_DEBIAN_V6'
 end
 
 if sshallowed.length == 0

diff --git a/modules/nagios/manifests/client.pp b/modules/nagios/manifests/client.pp
index 9cea3378a4fec2f3abd6a5cc1fb167c832bb7ed2..85c471fc9bde87555868f39fcbd79582828f1a1f 100644 (file)
--- a/modules/nagios/manifests/client.pp
+++ b/modules/nagios/manifests/client.pp
@@ -45,8 +45,13 @@ class nagios::client inherits nagios {
                path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
                refreshonly => true,
        }
-        @ferm::rule { "dsa-nagios":
+        @ferm::rule { "dsa-nagios-v4":
                 description     => "Allow nrpe from nagios master",
-                rule            => "proto tcp mod state state (NEW) dport (5666) @subchain 'nagios' { saddr (\$HOST_NAGIOS) ACCEPT; }"
+                rule            => "proto tcp mod state state (NEW) dport (5666) @subchain 'nagios' { saddr (\$HOST_NAGIOS_V4) ACCEPT; }"
+        }
+        @ferm::rule { "dsa-nagios-v6":
+                description     => "Allow nrpe from nagios master",
+                domain          => "ip6",
+                rule            => "proto tcp mod state state (NEW) dport (5666) @subchain 'nagios' { saddr (\$HOST_NAGIOS_V6) ACCEPT; }"
         }
 }

diff --git a/modules/named/manifests/recursor.pp b/modules/named/manifests/recursor.pp
new file mode 100644 (file)
index 0000000..61ca459
--- /dev/null
+++ b/modules/named/manifests/recursor.pp
@@ -0,0 +1,8 @@
+class named::recursor inherits named {
+    file { "/etc/bind/named.conf.options":
+        content => template("named/named.conf.options.erb"),
+        notify  => Exec["bind9 reload"],
+    }
+}
+
+

diff --git a/modules/named/templates/named.conf.options.erb b/modules/named/templates/named.conf.options.erb
index 457dcda2010d623f853d16fe20b03d6f3806e3c6..a2f309e27f2f97542b5bd149847d7959a96144cc 100644 (file)
--- a/modules/named/templates/named.conf.options.erb
+++ b/modules/named/templates/named.conf.options.erb
@@ -30,7 +30,7 @@ options {
 
 <%=
   allowed='Nagios; '
-  if classes.include?('named::secondary')
+  if classes.include?('named::secondary') or classes.include?('named::recursor')
     allowed += 'localnets; '
   end
 

diff --git a/modules/resolv/templates/resolv.conf.erb b/modules/resolv/templates/resolv.conf.erb
index 5c120ba834a51aed424d459b350decb704c62447..785a419ca840c4c17cb1992807c42f67287e5a5a 100644 (file)
--- a/modules/resolv/templates/resolv.conf.erb
+++ b/modules/resolv/templates/resolv.conf.erb
@@ -14,7 +14,7 @@ case hoster
       when "draghi", "liszt" then
         nameservers << "127.0.0.1"
     end
-    nameservers += ["82.195.75.81", "82.195.66.249", "217.198.242.225"]
+    nameservers += ["82.195.75.91", "82.195.75.81", "82.195.66.249", "217.198.242.225"]
     searchpaths << "debprivate-darmstadt.debian.org"
   when "ftcollins" then
     case hostname

diff --git a/modules/samhain/templates/samhainrc.erb b/modules/samhain/templates/samhainrc.erb
index 0ed6a86571b4684bbe37f68c110cb51bc24216b3..1c1b30603a32083f0d4fab49953b786e980316f1 100644 (file)
--- a/modules/samhain/templates/samhainrc.erb
+++ b/modules/samhain/templates/samhainrc.erb
@@ -78,8 +78,8 @@ IgnoreMissing=/etc/lvm/archive/vg.*.vg
 file=/etc/mtab
 file=/etc/ssh_random_seed
 file=/etc/asound.conf
-<% case hoster when "ubcece", "darmstadt", "ftcollins" then ""
-else -%>
+<% case hoster when "ubcece", "darmstadt", "ftcollins", "grnet" then -%>
+<% else -%>
 file=/etc/resolv.conf
 <% end -%>
 file=/etc/localtime
@@ -95,15 +95,16 @@ file=/etc/network/run/ifstate
 file=/var/state/samhain/samhain_file
 file=/etc/bind/zones/db.debian.net
 file=/etc/exim4/bsmtp
-<% if hostname == "geo1" || hostname == "geo2" || hostname == "geo3" -%>
+<% if classes.include?("named::geodns") -%>
 file=/etc/bind
 file=/etc/bind/named.conf.acl
-file=/etc/bind/named.conf.options
 file=/etc/bind/named.conf.local
 file=/etc/bind/geodns/named.conf.geo
 file=/etc/bind/geodns/recvconf.files
 <% end -%>
-
+<% if classes.include?("named") -%>
+file=/etc/bind/named.conf.options
+<% end -%>
 
 #
 # There are files in /etc that might change, thus changing the directory
@@ -133,13 +134,9 @@ file=/etc/nagios
 file=/etc/nagios/nrpe.d
 file=/etc/nagios/obsolete-packages-ignore.d
 file=/etc/bind/geodns
-<%= extradir=""
-if nodeinfo['nagiosmaster']
-  extradir="file=/etc/nagios3/puppetconf.d
-file=/etc/puppet"
-end
-extradir
-%>
+<% if nodeinfo['nagiosmaster'] -%>
+file=/etc/nagios3/puppetconf.d
+<% end -%>
 file=/etc/puppet
 file=/etc/cron.d
 file=/usr/lib/nagios/plugins
@@ -149,6 +146,9 @@ file=/etc/monit/monit.d
 file=/etc/pam.d
 file=/etc/sysctl.d
 file=/etc/syslog-ng
+file=/etc/ferm/
+file=/etc/ferm/conf.d
+file=/etc/ferm/dsa.d
 
 
 [LogFiles]
@@ -211,10 +211,9 @@ file=/var/log/syslog
 ##
 ## This file might be created or removed by the system sometimes.
 ##
-<% case hoster when "ubcece", "darmstadt", "ftcollins" then "" -%>
+<% case hoster when "ubcece", "darmstadt", "ftcollins", "grnet" then -%>
 file=/etc/resolv.conf
-<% else
-end -%>
+<% end -%>
 file=/etc/resolv.conf.pcmcia.save
 file=/etc/nologin
 file=/etc/postfix/debian.db
@@ -360,27 +359,38 @@ file=/etc/monit/monit.d/01puppet
 file=/etc/monit/monit.d/00debian.org
 file=/etc/cron.d/dsa-puppet-stuff
 file=/etc/cron.d/dsa-buildd
-<%= extrafiles=""
-case fqdn 
-when "tchaikovsky.debian.org": extrafiles="file=/etc/nagios3/puppetconf.d/auto-hostgroups.cfg
+<% if nodeinfo['nagiosmaster'] -%>
+file=/etc/nagios3/puppetconf.d/auto-hostgroups.cfg
 file=/etc/nagios3/puppetconf.d/auto-hosts.cfg
 file=/etc/nagios3/puppetconf.d/auto-services.cfg
 file=/etc/nagios3/puppetconf.d/auto-dependencies.cfg
 file=/etc/nagios3/puppetconf.d/auto-hostextinfo.cfg
 file=/etc/nagios3/puppetconf.d/auto-serviceextinfo.cfg
-file=/etc/munin/munin.conf"
-when "handel.debian.org": extrafiles="dir=8/etc/puppet"
-when "dijkstra.debian.org": extrafiles="dir=4/etc/dsa-kvm"
-when /geo[123].debian.org/: extrafiles="dir=1/etc/bind/geodns"
-when /(senfl|ravel|orff|klecker).debian.org/: extrafiles="dir=1/etc/bind
-file=/etc/bind/named.conf.debian-zones"
-end
-extrafiles
-%>
+<% end -%>
+<% if nodeinfo['muninmaster'] -%>
+file=/etc/munin/munin.conf
+<% end -%>
+<% if nodeinfo['puppetmaster'] -%>
+dir=8/etc/puppet
+<% end -%>  
+<% if classes.include?('named::geodns') -%>
+dir=1/etc/bind/geodns
+<% end -%>
+<% if classes.include?('named::secondary') -%>
+dir=1/etc/bind
+file=/etc/bind/named.conf.debian-zones
+<% end -%>
+<% if fqdn == "dijkstra.debian.org" -%>
+dir=4/etc/dsa-kvm
+<% end -%>
 
 <% if nodeinfo['buildd'] -%>
 dir=3/etc/lvm
 <% end -%>
+dir=1/etc/ferm/dsa.d
+file=/etc/ferm/conf.d/me.conf
+file=/etc/ferm/conf.d/defs.conf
+file=/etc/ferm/ferm.conf
 
 [IgnoreNone]
 ##
@@ -825,19 +835,12 @@ SetMailNum = 10
 SetMailAddress=samhain-reports@debian.org
 
 ## Mail relay (IP address)
-<%=
-out=""
-if not nodeinfo['smarthost'].empty?
-  out = '
-SetMailRelay = localhost
-'
-else
-out = '
+<% if nodeinfo['smarthost'].empty? -%>
 SetMailRelay = master.debian.org
-'
-end
-out
-%>
+<% else -%>
+SetMailRelay = localhost
+<% end -%>
+
 ## Custom subject format
 #
 MailSubject = [Samhain at %H] %T: %S