From: Peter Palfrader Date: Sun, 14 Jul 2013 07:33:58 +0000 (+0200) Subject: ferm defs cleanup, and make sure static works even if we ssh restrict the participati... X-Git-Url: https://git.donarmstrong.com/?p=dsa-puppet.git;a=commitdiff_plain;h=adb56cc2c65d33cf3a1adb0464a91744728e41d7 ferm defs cleanup, and make sure static works even if we ssh restrict the participating hosts --- diff --git a/modules/ferm/templates/defs.conf.erb b/modules/ferm/templates/defs.conf.erb index ef88d6b1..d94c62f5 100644 --- a/modules/ferm/templates/defs.conf.erb +++ b/modules/ferm/templates/defs.conf.erb @@ -19,154 +19,55 @@ proto (tcp udp) dport $port @subchain "$port" { saddr ($srange) ACCEPT; }" } -@def $HOST_MAILRELAY_V4 = (<%= - mailrelay = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['mailrelay'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /:/ - mailrelay << ip - end +<% + rolehost={} + localinfo = scope.lookupvar('site::localinfo') + allnodeinfo = scope.lookupvar('site::allnodeinfo') + + %w{mailrelay nagiosmaster extranrpeclient muninmaster dbmaster static_mirror static_source static_master}.each do |role| + rolehost[role] = [] + localinfo.keys.sort.each do |node| + if localinfo[node][role] + rolehost[role] << allnodeinfo[node]['ipHostNumber'] end + end + rolehost[role].flatten! end - mailrelay.join(' ') -%>); - -@def $HOST_MAILRELAY_V6 = (<%= - mailrelay = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['mailrelay'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /\./ - mailrelay << ip - end - end + dbs = [] + allnodeinfo.keys.sort.each do |node| + next unless allnodeinfo[node].has_key?('ipHostNumber') + dbs << allnodeinfo[node]['ipHostNumber'] end + dbs.flatten! +%> - mailrelay.join(' ') -%>); - +@def $HOST_MAILRELAY_V4 = (<%= scope.function_filter_ipv4([rolehost['mailrelay']]).uniq.join(' ') %>); +@def $HOST_MAILRELAY_V6 = (<%= scope.function_filter_ipv6([rolehost['mailrelay']]).uniq.join(' ') %>); @def $HOST_MAILRELAY = ( $HOST_MAILRELAY_V4 $HOST_MAILRELAY_V6 ); -@def $HOST_NAGIOS_V4 = (<%= - nagii = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['nagiosmaster'] or scope.lookupvar('site::localinfo')[node]['extranrpeclient'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /:/ - nagii << ip - end - end - end - - nagii.join(' ') -%>); - -@def $HOST_NAGIOS_V6 = (<%= - nagii = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['nagiosmaster'] or scope.lookupvar('site::localinfo')[node]['extranrpeclient'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /\./ - nagii << ip - end - end - end - - nagii.join(' ') -%>); - +@def $HOST_NAGIOS_V4 = (<%= scope.function_filter_ipv4([rolehost['nagiosmaster'] + rolehost['extranrpeclient']]).uniq.join(' ') %>); +@def $HOST_NAGIOS_V6 = (<%= scope.function_filter_ipv6([rolehost['nagiosmaster'] + rolehost['extranrpeclient']]).uniq.join(' ') %>); @def $HOST_NAGIOS = ( $HOST_NAGIOS_V4 $HOST_NAGIOS_V6 ); -@def $HOST_MUNIN_V4 = (<%= - munins = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['muninmaster'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /:/ - munins << ip - end - end - end - - munins.join(' ') -%>); - -@def $HOST_MUNIN_V6 = (<%= - munins = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['muninmaster'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /\./ - munins << ip - end - end - end - - munins.join(' ') -%>); - +@def $HOST_MUNIN_V4 = (<%= scope.function_filter_ipv4([rolehost['muninmaster']]).uniq.join(' ') %>); +@def $HOST_MUNIN_V6 = (<%= scope.function_filter_ipv6([rolehost['muninmaster']]).uniq.join(' ') %>); @def $HOST_MUNIN = ( $HOST_MUNIN_V4 $HOST_MUNIN_V6 ); -@def $HOST_DB_V6 = (<%= - dbs = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['dbmaster'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /\./ - dbs << ip - end - end - end - - dbs.join(' ') -%>); - -@def $HOST_DB_V4 = (<%= - dbs = [] - scope.lookupvar('site::localinfo').keys.sort.each do |node| - if scope.lookupvar('site::localinfo')[node]['dbmaster'] - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /:/ - dbs << ip - end - end - end - - dbs.join(' ') -%>); - -@def $HOST_DB = ($HOST_DB_V4 $HOST_DB_V6); - -@def $HOST_DEBIAN_V4 = (<%= - dbs = [] - scope.lookupvar('site::allnodeinfo').keys.sort.each do |node| - next unless scope.lookupvar('site::allnodeinfo')[node].has_key?('ipHostNumber') - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /:/ - dbs << ip - end - end +@def $HOST_DB_V4 = (<%= scope.function_filter_ipv4([rolehost['dbmaster']]).uniq.join(' ') %>); +@def $HOST_DB_V6 = (<%= scope.function_filter_ipv6([rolehost['dbmaster']]).uniq.join(' ') %>); +@def $HOST_DB = ( $HOST_DB_V4 $HOST_DB_V6 ); - dbs.join(' ') -%>); - -@def $HOST_DEBIAN_V6 = (<%= - dbs = [] - scope.lookupvar('site::allnodeinfo').keys.sort.each do |node| - next unless scope.lookupvar('site::allnodeinfo')[node].has_key?('ipHostNumber') - scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| - next if ip =~ /\./ - dbs << ip - end - end - - dbs.join(' ') -%>); +@def $HOST_STATICMASTER_V4 = (<%= scope.function_filter_ipv4([rolehost['static_master']]).uniq.join(' ') %>); +@def $HOST_STATICMASTER_V6 = (<%= scope.function_filter_ipv6([rolehost['static_master']]).uniq.join(' ') %>); +@def $HOST_STATIC_V4 = (<%= scope.function_filter_ipv4([rolehost['static_mirror'] + rolehost['static_source'] + rolehost['static_master']]).uniq.join(' ') %>); +@def $HOST_STATIC_V6 = (<%= scope.function_filter_ipv6([rolehost['static_mirror'] + rolehost['static_source'] + rolehost['static_master']]).uniq.join(' ') %>); +@def $HOST_DEBIAN_V4 = (<%= scope.function_filter_ipv4([dbs]).uniq.join(' ') %>); +@def $HOST_DEBIAN_V6 = (<%= scope.function_filter_ipv6([dbs]).uniq.join(' ') %>); @def $HOST_DEBIAN = ($HOST_DEBIAN_V4 $HOST_DEBIAN_V6); + @def $sgran = (91.103.132.24/29 85.158.45.51/32); @def $weasel = (); @def $weasel = ($weasel 86.59.118.144/28); # debian@sil diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb index 7f2a75c9..94562a5a 100644 --- a/modules/ferm/templates/me.conf.erb +++ b/modules/ferm/templates/me.conf.erb @@ -4,13 +4,15 @@ ## <%= +nodeinfo = scope.lookupvar('site::nodeinfo') + out = [] restricted_purposes = ['kvm host', 'central syslog server', 'puppet master', 'jumphost'] restrict_ssh = %w{lebrun geo1 geo2 geo3 beethoven tchaikovsky schroeder draghi} -if (scope.lookupvar('site::nodeinfo')['ldap'].has_key?('purpose')) then - scope.lookupvar('site::nodeinfo')['ldap']['purpose'].each do |purp| +if (nodeinfo['ldap'].has_key?('purpose')) then + nodeinfo['ldap']['purpose'].each do |purp| if restricted_purposes.include?(purp) then restrict_ssh << hostname end @@ -23,19 +25,28 @@ ssh6allowed = [] if restrict_ssh.include?(hostname) then ssh4allowed << %w{$DSA_IPS $HOST_NAGIOS_V4 $HOST_MUNIN_V4 $HOST_DB_V4} ssh6allowed << %w{$DSA_V6_IPS $HOST_NAGIOS_V6 $HOST_MUNIN_V6 $HOST_DB_V6} -end -if %w{lebrun schroeder}.include?(hostname) then - out << '@def $CARNET = ( 193.198.184.8/29 161.53.160.133 161.53.160.90 161.53.11.222 161.53.12.134 161.53.12.142 161.53.12.143 );' - ssh4allowed << '$CARNET' - ssh4allowed << '$BUILDD_SSH_ACCESS' -end -if %w{beethoven draghi}.include?(hostname) then - ssh4allowed << '$HOST_DEBIAN_V4' - ssh6allowed << '$HOST_DEBIAN_V6' -end -if %w{unger}.include?(hostname) then - ssh4allowed << '$UNGER_SSH_ACCESS' # Ganneff - ssh6allowed << '$UNGER_SSH6_ACCESS' # Ganneff, but more address space + + if %w{lebrun schroeder}.include?(hostname) then + out << '@def $CARNET = ( 193.198.184.8/29 161.53.160.133 161.53.160.90 161.53.11.222 161.53.12.134 161.53.12.142 161.53.12.143 );' + ssh4allowed << '$CARNET' + ssh4allowed << '$BUILDD_SSH_ACCESS' + end + if %w{beethoven draghi}.include?(hostname) then + ssh4allowed << '$HOST_DEBIAN_V4' + ssh6allowed << '$HOST_DEBIAN_V6' + end + if %w{unger}.include?(hostname) then + ssh4allowed << '$UNGER_SSH_ACCESS' # Ganneff + ssh6allowed << '$UNGER_SSH6_ACCESS' # Ganneff, but more address space + end + + if nodeinfo['static_master'] then + ssh4allowed << '$HOST_STATIC_V4' + ssh6allowed << '$HOST_STATIC_V6' + elsif nodeinfo['static_source'] or nodeinfo['static_mirror'] then + ssh4allowed << '$HOST_STATICMASTER_V4' + ssh6allowed << '$HOST_STATICMASTER_V6' + end end ssh4allowed.length == 0 and ssh4allowed << '0.0.0.0/0' ssh6allowed.length == 0 and ssh6allowed << '::/0' @@ -49,7 +60,7 @@ out << "@def $SSH_V6_SOURCES = (#{ssh6allowed.join(' ')});" smtp4allowed = [] smtp6allowed = [] -if not scope.lookupvar('site::nodeinfo')['smarthost'].empty? +if not nodeinfo['smarthost'].empty? smtp4allowed << %w{$HOST_MAILRELAY_V4 $HOST_NAGIOS_V4} smtp6allowed << %w{$HOST_MAILRELAY_V6 $HOST_NAGIOS_V6} end