47 lines
2.2 KiB
YAML
47 lines
2.2 KiB
YAML
---
|
|
#--------------------------------------------------------------#
|
|
# NODE SELinux [node_selinux]
|
|
#--------------------------------------------------------------#
|
|
- name: set node selinux mode
|
|
tags: [ node_sec, node_selinux ]
|
|
when: node_selinux_mode|default('permissive')|lower in ['enforcing', 'permissive', 'disabled']
|
|
ignore_errors: true
|
|
shell: |
|
|
MODE="{{ node_selinux_mode|default('permissive')|lower }}"
|
|
command -v getenforce &>/dev/null || exit 0
|
|
[ -f /etc/selinux/config ] && sed -i "s/^SELINUX=.*/SELINUX=$MODE/" /etc/selinux/config
|
|
[ "$(getenforce 2>/dev/null)" = "Disabled" ] && exit 0
|
|
[ "$MODE" = "enforcing" ] && setenforce 1 || setenforce 0
|
|
args: { executable: /bin/bash }
|
|
|
|
#--------------------------------------------------------------#
|
|
# Firewall [node_firewall]
|
|
#--------------------------------------------------------------#
|
|
# mode: off (disable firewall), none (do nothing), zone (trust intranet)
|
|
- name: setup node firewall
|
|
tags: [ node_sec, node_firewall ]
|
|
when: node_firewall_mode|default('none') != 'none'
|
|
ignore_errors: true
|
|
vars:
|
|
fw_intranet: "{{ node_firewall_intranet | default([]) | join(' ') }}"
|
|
fw_public: "{{ node_firewall_public_port | default([]) | join(' ') }}"
|
|
shell: |
|
|
MODE="{{ node_firewall_mode }}"
|
|
INTRANET="{{ fw_intranet }}"
|
|
PUBLIC="{{ fw_public }}"
|
|
if command -v firewall-cmd &>/dev/null; then
|
|
[[ "$MODE" == "off" ]] && { systemctl disable --now firewalld &>/dev/null; exit 0; }
|
|
systemctl is-active firewalld &>/dev/null || systemctl enable --now firewalld &>/dev/null
|
|
for cidr in $INTRANET; do firewall-cmd --zone=trusted --add-source=$cidr &>/dev/null; done
|
|
for port in $PUBLIC; do firewall-cmd --zone=public --add-port=${port}/tcp &>/dev/null; done
|
|
firewall-cmd --runtime-to-permanent &>/dev/null
|
|
elif command -v ufw &>/dev/null; then
|
|
[[ "$MODE" == "off" ]] && { ufw disable &>/dev/null; exit 0; }
|
|
for cidr in $INTRANET; do ufw allow from $cidr &>/dev/null; done
|
|
for port in $PUBLIC; do ufw allow ${port}/tcp &>/dev/null; done
|
|
ufw --force enable
|
|
fi
|
|
/bin/true;
|
|
args: { executable: /bin/bash }
|
|
...
|