ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Reduce output from ansible playbooks. Some minor changes.

Browse Source
This commit is contained in:
Christoph
2019-07-03 04:14:14 +02:00
parent 21fcd86115
commit 505cdbf120
25 changed files with 3158 additions and 615 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
scripts/first-run.retry
View File

@ -1 +0,0 @@
o25.oopen.de

117
scripts/first-run.yml
View File

@ -1,11 +1,118 @@
---
- hosts: o25.oopen.de
- hosts: extra_hosts
tasks:
- name: Ensure aptitude is present
raw: test -e /usr/bin/aptitude || apt-get install aptitude -y
- name: (apt.yml) apt update
apt:
update_cache: true
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
when: apt_update|bool
- name: (apt.yml) dpkg --configure
command: >
dpkg --configure -a
args:
warn: false
changed_when: _dpkg_configure.stdout_lines | length
register: _dpkg_configure
when: apt_dpkg_configure|bool
- name: Install ulogd2
apt:
name: ulogd2
state: present
default_release: "{{ ansible_distribution_release }}"
tags:
- ulogd
- apt-ulogd
- name: Check if file '/etc/ulogd.conf.ORIG' exists
stat:
path: /etc/ulogd.conf.ORIG
register: ulogd_conf_orig_exists
tags:
- ulogd
- name: Backup existing file /etc/ulogd.conf
command: cp /etc/ulogd.conf /etc/ulogd.conf.ORIG
when: ulogd_conf_orig_exists.stat.exists == False
tags:
- ulogd
- name: Adjust file '/etc/ulogd.conf' 1/2
blockinfile:
path: /etc/ulogd.conf
insertafter: '^#?\s*plugin="/usr/lib'
block: |
# ====================================================================
# Define two new plugin stacks inside for iptables logging
# ====================================================================
# -
# - firewall11 - for IPv4 Firewall
# - firewall12 - for IPv6 Firewall
# -
stack=firewall11:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu11:LOGEMU
stack=firewall12:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu12:LOGEMU
marker: "# {mark} ANSIBLE MANAGED BLOCK 1/2"
state: present
register: ulogd_conf_1
notify: Restart ulogd
- name: Adjust file '/etc/ulogd.conf' 2/2
blockinfile:
path: /etc/ulogd.conf
insertafter: EOF
block: |
# =========================================================
# Define input plugins using specified netlink group inside
# =========================================================
[firewall11]
group=11
[firewall12]
group=12
# =====================
# Define output plugins
# =====================
[emu11]
file="/var/log/ulog/iptables.log"
sync=1
[emu12]
file="/var/log/ulog/ip6tables.log"
sync=1
marker: "# {mark} ANSIBLE MANAGED BLOCK 2/2"
state: present
register: ulogd_conf_1
notify: Restart ulogd
- name: Insert Headline to file '/etc/ulogd.conf'
blockinfile:
path: /etc/ulogd.conf
insertbefore: BOF
block: |
#
# --------------------------
# ** DO NOT EDIT DIRECTLY **
# --------------------------
# Ansible managed file
#
marker: "# {mark}"
handlers:
- name: Restart ulogd
service:
name: ulogd
state: restarted
- name: Ensure python2 is present (This is necessary for ansible to work properly)
raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)

46
scripts/first-run.yml.BAK Normal file
View File

@ -0,0 +1,46 @@
---
- hosts: extra_hosts
tasks:
- name: Install ulogd2
apt:
name: ulogd2
state: present
default_release: "{{ ansible_distribution_release }}"
tags:
- ulogd
- apt-ulogd
- name: Check if file '/etc/ulogd.conf.ORIG' exists
stat:
path: /etc/ulogd.conf.ORIG
register: ulogd_conf_orig_exists
tags:
- ulogd
- name: Backup existing file /etc/ulogd.conf
command: cp /etc/ulogd.conf /etc/ulogd.conf.ORIG
when: ulogd_conf_orig_exists.stat.exists == False
tags:
- ulogd
- name: Adjust file '/etc/ulogd.conf' 1/2
lineinfile:
path: /etc/ulogd.conf
insertafter: '^plugin="/usr/lib'
block: |
{{ item.entry }}
with_items:
- { entry: '' }
- { entry: '# ====================================================================' }
- { entry: '# Define two new plugin stacks inside for iptables logging' }
- { entry: '# ====================================================================' }
- { entry: '# -' }
- { entry: '# - firewall11 - for IPv4 Firewall' }
- { entry: '# - firewall12 - for IPv6 Firewall' }
- { entry: '# -' }
- { entry: 'stack=firewall11:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu11:LOGEMU' }
- { entry: 'stack=firewall12:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu12:LOGEMU' }
- { entry: '' }

455
scripts/install-firewall.yml Normal file
View File

@ -0,0 +1,455 @@
---
- hosts: all
tasks:
# ---
# Create firewall config directory '/etc/ipt/firewall' if not exists
# ---
#
- name: Install/update firewall repository
git:
repo: '{{ git_firewall_repository.repo }}'
dest: '{{ git_firewall_repository.dest }}'
when: git_firewall_repository is defined and git_firewall_repository > 0
tags:
- git-firewall-repository
- name: Create directory /etc/ipt-firewall if not exists
file:
path: /etc/ipt-firewall
state: directory
# ---
# Get information about network devices
# ---
- name: define traditional ethernet facts
set_fact:
ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}"
when:
- hostvars[inventory_hostname]['ansible_' + item]['type'] == 'ether'
- inventory_hostname not in groups['lxc_host']|string
with_items:
- "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}"
- name: define traditional ibridge facts
set_fact:
#ansible_netdev: "{% set ansible_netdev = ansible_br|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_br|list }}"
ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}"
when:
- hostvars[inventory_hostname]['ansible_' + item]['type'] == 'bridge'
- "groups['lxc_host']|string is search(inventory_hostname)"
with_items:
- "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}"
- name: Debug message
debug:
msg:
- "index: {{ idx + 1 }}"
- "device: {{ item.device }}"
- "ipv4-address {{ item.ipv4.address }} "
- "ipv6-address: {{ item.ipv6.0.address }}"
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
# ---
# Check presence of files
# ---
- name: Check if /etc/ipt-firewall/interfaces_ipv4.conf are present
stat:
path: /etc/ipt-firewall/interfaces_ipv4.conf
register: interfaces_ipv4_exists
- name: Check if /etc/ipt-firewall/interfaces_ipv6.conf are present
stat:
path: /etc/ipt-firewall/interfaces_ipv6.conf
register: interfaces_ipv6_exists
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv4.conf
register: main_ipv4_exists
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv6.conf
register: main_ipv6_exists
- name: Check if /etc/ipt-firewall/ban_ipv4.list are present
stat:
path: /etc/ipt-firewall/ban_ipv4.list
register: ban_ipv4_exists
- name: Check if /etc/ipt-firewall/ban_ipv6.list are present
stat:
path: /etc/ipt-firewall/ban_ipv6.list
register: ban_ipv6_exists
# ===
# Update/Modify firewall
# ===
# ---
# Host specific configuration files
# ---
# /etc/ipt-firewall/interfaces_ipv[4|6].conf
#
- name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv4.conf'
command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv4.conf.sample /etc/ipt-firewall/interfaces_ipv4.conf
when: not interfaces_ipv4_exists.stat.exists
register: new_interfaces_ipv4
- name: Configure interfaces_ipv4.conf 1/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv4.conf
regexp: '^ext_if_{{ idx + 1 }}='
line: 'ext_if_{{ idx + 1 }}="{{ item.device }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv4_exists.stat.exists
- new_interfaces_ipv4 is changed
- name: Configure interfaces_ipv4.conf 2/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv4.conf
regexp: '^ext_{{ idx + 1 }}_ip='
line: 'ext_{{ idx + 1 }}_ip="{{ item.ipv4.address }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv4_exists.stat.exists
- new_interfaces_ipv4 is changed
- name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv6.conf'
command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv6.conf.sample /etc/ipt-firewall/interfaces_ipv6.conf
when: not interfaces_ipv6_exists.stat.exists
register: new_interfaces_ipv6
- name: Configure interfaces_ipv6.conf 1/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv6.conf
regexp: '^ext_if_{{ idx + 1 }}='
line: 'ext_if_{{ idx + 1 }}="{{ item.device }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv6_exists.stat.exists
- new_interfaces_ipv6 is changed
- name: Configure interfaces_ipv4.conf 2/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv6.conf
regexp: '^ext_{{ idx + 1 }}_ip='
line: 'ext_{{ idx + 1 }}_ip="{{ item.ipv6.0.address }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv6_exists.stat.exists
- new_interfaces_ipv6 is changed
# /etc/ipt-firewall/ban_ipv[4|6].list
#
- name: Place new configuration file '/etc/ipt-firewall/ban_ipv4.list'
command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv4.list.sample /etc/ipt-firewall/ban_ipv4.list
when: not ban_ipv4_exists.stat.exists
- name: Place new configuration file '/etc/ipt-firewall/ban_ipv6.list'
command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv6.list.sample /etc/ipt-firewall/ban_ipv6.list
when: not ban_ipv6_exists.stat.exists
# /etc/ipt-firewall/main_ipv[4|6].conf
#
- name: Place new configuration file '/etc/ipt-firewall/main_ipv4.conf'
command: cp {{ git_firewall_repository.dest }}/conf/main_ipv4.conf.sample /etc/ipt-firewall/main_ipv4.conf
when: not main_ipv4_exists.stat.exists
register: cp_main_ipv4
- name: Place new configuration file '/etc/ipt-firewall/main_ipv6.conf'
command: cp {{ git_firewall_repository.dest }}/conf/main_ipv6.conf.sample /etc/ipt-firewall/main_ipv6.conf
when: not main_ipv6_exists.stat.exists
register: cp_main_ipv6
# Configure main_ipv4.conf
#
- name: Configure main_ipv4.conf (dns_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*dns_server_ips'
line: dns_server_ips="$ext_ips"
state: present
when:
- "groups['dns_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (ssh_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*ssh_server_ips'
line: ssh_server_ips="$ext_ips"
state: present
when:
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (http_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*http_server_ips='
line: http_server_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (mail_client_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*mail_client_ips='
line: mail_client_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (smtpd_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*smtpd_ips='
line: smtpd_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (mail_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*mail_server_ips='
line: mail_server_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (ftp_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*ftp_server_ips='
line: ftp_server_ips="$ext_1_ip"
state: present
when:
- "groups['ftp_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (mumble_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*mumble_server_ips='
line: mumble_server_ips="$ext_1_ip"
state: present
when:
- "groups['mumble_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
# Configure main_ipv6.conf
#
- name: Configure main_ipv6.conf (dns_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*dns_server_ips'
line: dns_server_ips="$ext_ips"
state: present
when:
- "groups['dns_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (ssh_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*ssh_server_ips'
line: ssh_server_ips="$ext_ips"
state: present
when:
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (http_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*http_server_ips='
line: http_server_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (mail_client_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*mail_client_ips='
line: mail_client_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (smtpd_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*smtpd_ips='
line: smtpd_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (mail_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*mail_server_ips='
line: mail_server_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (ftp_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*ftp_server_ips='
line: ftp_server_ips="$ext_1_ip"
state: present
when:
- "groups['ftp_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (mumble_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*mumble_server_ips='
line: mumble_server_ips="$ext_1_ip"
state: present
when:
- "groups['mumble_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
# ---
# Host independet configuration files
# ---
- name: Check if common configuration files are latest
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
changed_when: "diff_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_output.rc > 2"
when: git_firewall_repository is defined and git_firewall_repository > 0
loop:
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- default_ports.conf
- post_decalrations.conf
register: diff_output
- name: Ensure common configuration files are latest
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
loop:
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- default_ports.conf
- post_decalrations.conf
when:
- git_firewall_repository is defined and git_firewall_repository > 0
- diff_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
# ---
# Firewall scripts
# ---
- name: Check if firewall scripts are latest
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
changed_when: "diff_script_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_script_output.rc > 2"
when: git_firewall_repository is defined and git_firewall_repository > 0
loop:
- ipt-firewall-server
- ip6t-firewall-server
register: diff_script_output
- name: Ensure firewall scripts are latest
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
loop:
- ipt-firewall-server
- ip6t-firewall-server
when:
- git_firewall_repository is defined and git_firewall_repository > 0
- diff_script_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
handlers:
- name: Restart ulogd
service:
name: ulogd
state: restarted
- name: Restart IPv4 Firewall
service:
name: ipt-firewall
state: restarted
- name: Restart IPv6 Firewall
service:
name: ip6t-firewall
state: restarted

132
scripts/install-ulogd.yml Normal file
View File

@ -0,0 +1,132 @@
---
- hosts: extra_hosts
tasks:
- name: (apt.yml) apt update
apt:
update_cache: true
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
when: apt_update|bool
- name: (apt.yml) dpkg --configure
command: >
dpkg --configure -a
args:
warn: false
changed_when: _dpkg_configure.stdout_lines | length
register: _dpkg_configure
when: apt_dpkg_configure|bool
- name: Install ulogd2
apt:
name: ulogd2
state: present
default_release: "{{ ansible_distribution_release }}"
tags:
- ulogd
- apt-ulogd
- name: Check if file '/etc/ulogd.conf.ORIG' exists
stat:
path: /etc/ulogd.conf.ORIG
register: ulogd_conf_orig_exists
tags:
- ulogd
- name: Backup existing file /etc/ulogd.conf
command: cp /etc/ulogd.conf /etc/ulogd.conf.ORIG
when: ulogd_conf_orig_exists.stat.exists == False
tags:
- ulogd
- name: Check if String 'stack=firewall11=..' is present
shell: grep -q -E "^\s*stack=firewall11" /etc/ulogd.conf
register: stack_firewall11_present
failed_when: "stack_firewall11_present.rc > 1"
changed_when: "stack_firewall11_present.rc > 0"
- name: Adjust file '/etc/ulogd.conf' 1/2
blockinfile:
path: /etc/ulogd.conf
insertafter: '^#?\s*plugin="/usr/lib'
block: |
# ====================================================================
# Define two new plugin stacks inside for iptables logging
# ====================================================================
# -
# - firewall11 - for IPv4 Firewall
# - firewall12 - for IPv6 Firewall
# -
stack=firewall11:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu11:LOGEMU
stack=firewall12:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu12:LOGEMU
marker: "# {mark} ANSIBLE MANAGED BLOCK 1/2"
state: present
#register: ulogd_conf_1
when: stack_firewall11_present is changed
notify: Restart ulogd
- name: Check if String '[firewall11]' is present
shell: grep -q -E "^\s*\[firewall11\]" /etc/ulogd.conf
register: stack_group_firewall11_present
failed_when: "stack_group_firewall11_present.rc > 1"
changed_when: "stack_group_firewall11_present.rc > 0"
- name: Adjust file '/etc/ulogd.conf' 2/2
blockinfile:
path: /etc/ulogd.conf
insertafter: EOF
block: |
# =========================================================
# Define input plugins using specified netlink group inside
# =========================================================
[firewall11]
group=11
[firewall12]
group=12
# =====================
# Define output plugins
# =====================
[emu11]
file="/var/log/ulog/iptables.log"
sync=1
[emu12]
file="/var/log/ulog/ip6tables.log"
sync=1
marker: "# {mark} ANSIBLE MANAGED BLOCK 2/2"
state: present
#register: ulogd_conf_2
when: stack_group_firewall11_present is changed
notify: Restart ulogd
# ---
# Remove Marker set by blockinfile
# ---
- name: Remove marker
replace :
path: /etc/ulogd.conf
regexp: "^#.*ANSIBLE MANAGED BLOCK.*$"
replace: ""
#register: marker_ipv4_removed
handlers:
- name: Restart ulogd
service:
name: ulogd
state: restarted

947
scripts/install-update-firewall.yml Normal file
View File

@ -0,0 +1,947 @@
---
- hosts: all
tasks:
# ---
# Create firewall config directory '/etc/ipt/firewall' if not exists
# ---
#
- name: Install/update firewall repository
git:
repo: '{{ git_firewall_repository.repo }}'
dest: '{{ git_firewall_repository.dest }}'
when: git_firewall_repository is defined and git_firewall_repository > 0
tags:
- git-firewall-repository
- name: Create directory /etc/ipt-firewall if not exists
file:
path: /etc/ipt-firewall
state: directory
# ---
# Check presence of files
# ---
- name: Check if /etc/ipt-firewall/interfaces_ipv4.conf are present
stat:
path: /etc/ipt-firewall/interfaces_ipv4.conf
register: interfaces_ipv4_exists
- name: Check if /etc/ipt-firewall/interfaces_ipv6.conf are present
stat:
path: /etc/ipt-firewall/interfaces_ipv6.conf
register: interfaces_ipv6_exists
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv4.conf
register: main_ipv4_exists
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv6.conf
register: main_ipv6_exists
- name: Check if /etc/ipt-firewall/ban_ipv4.list are present
stat:
path: /etc/ipt-firewall/ban_ipv4.list
register: ban_ipv4_exists
- name: Check if /etc/ipt-firewall/ban_ipv6.list are present
stat:
path: /etc/ipt-firewall/ban_ipv6.list
register: ban_ipv6_exists
# ---
# Get information about network devices
# ---
- name: define traditional ethernet facts
set_fact:
ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}"
when:
- not interfaces_ipv4_exists.stat.exists
- hostvars[inventory_hostname]['ansible_' + item]['type'] == 'ether'
- inventory_hostname not in groups['lxc_host']|string
with_items:
- "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}"
- name: define traditional ibridge facts
set_fact:
#ansible_netdev: "{% set ansible_netdev = ansible_br|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_br|list }}"
ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}"
when:
- not interfaces_ipv4_exists.stat.exists
- hostvars[inventory_hostname]['ansible_' + item]['type'] == 'bridge'
- "groups['lxc_host']|string is search(inventory_hostname)"
with_items:
- "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}"
- name: Debug message
debug:
msg:
- "index: {{ idx + 1 }}"
- "device: {{ item.device }}"
- "ipv4-address {{ item.ipv4.address }} "
- "ipv6-address: {{ item.ipv6.0.address }}"
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv4_exists.stat.exists
# ---
# Get sshd ports
# ---
- name: Get sshd ports as blank separated list
set_fact:
fw_sshd_ports: "{{ sshd_ports | join (' ') }}"
when:
- sshd_ports is defined and sshd_ports | length > 0
- sshd_ports|join() != "22"
- name: Set default sshd ports
set_fact:
fw_sshd_ports: "$standard_ssh_port"
when:
- sshd_ports is not defined or sshd_ports | length == 0 or sshd_ports|join() == "22"
# ===
# Modify main_ipv[4|].conf - add port definitionios
# ===
# ---
# vpn_ports
# ---
- name: Check if String 'vpn_ports=..' is present
shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv4.conf
register: vpn_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "vpn_ports_ipv4_present.rc > 1"
changed_when: "vpn_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (vpn_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_vpn_server_ips'
block: |
# - VPN Port(s) used by local Services
# -
# - blank separated list
# -
vpn_ports="$standard_vpn_port"
marker: "# Marker set by modify-ipt-server.yml (vpn_ports)"
when:
- main_ipv4_exists.stat.exists
- vpn_ports_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'vpn_ports=..' is present
shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv6.conf
register: vpn_ports_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "vpn_ports_ipv6_present.rc > 1"
changed_when: "vpn_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (vpn_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_vpn_server_ips'
block: |
# - VPN Port(s) used by local Services
# -
# - blank separated list
# -
vpn_ports="$standard_vpn_port"
marker: "# Marker set by modify-ipt-server.yml (vpn_ports)"
when:
- main_ipv6_exists.stat.exists
- vpn_ports_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# ssh_ports
# ---
- name: Check if String 'ssh_ports=..' is present
shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv4.conf
register: ssh_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "ssh_ports_ipv4_present.rc > 1"
changed_when: "ssh_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ssh_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_ssh_server_ips'
block: |
# - SSH Port(s) used by local Services
# -
# - blank separated list
# -
ssh_ports="{{ fw_sshd_ports }}"
marker: "# Marker set by modify-ipt-server.yml (ssh_ports)"
when:
- main_ipv4_exists.stat.exists
- ssh_ports_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'ssh_ports=..' is present
shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv6.conf
register: ssh_ports_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "ssh_ports_ipv6_present.rc > 1"
changed_when: "ssh_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ssh_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_ssh_server_ips'
block: |
# - SSH Port(s) used by local Services
# -
# - blank separated list
# -
ssh_ports="{{ fw_sshd_ports }}"
marker: "# Marker set by modify-ipt-server.yml (ssh_ports)"
when:
- main_ipv6_exists.stat.exists
- ssh_ports_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# http_ports
# ---
- name: Check if String 'http_ports=..' is present
shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv4.conf
register: http_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "http_ports_ipv4_present.rc > 1"
changed_when: "http_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (http_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_http_server_ips'
block: |
# - HTTP(S) Ports used by local Services
# -
# - comma separated list
# -
http_ports="$standard_http_ports"
marker: "# Marker set by modify-ipt-server.yml (http_ports)"
when:
- main_ipv4_exists.stat.exists
- http_ports_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'http_ports=..' is present
shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv6.conf
register: http_ports_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "http_ports_ipv6_present.rc > 1"
changed_when: "http_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (http_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_http_server_ips'
block: |
# - HTTP(S) Ports used by local Services
# -
# - comma separated list
# -
http_ports="$standard_http_ports"
marker: "# Marker set by modify-ipt-server.yml (http_ports)"
when:
- main_ipv6_exists.stat.exists
- http_ports_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# mail_user_ports
# ---
- name: Check if String 'mail_user_ports=..' is present
shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv4.conf
register: mail_user_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "mail_user_ports_ipv4_present.rc > 1"
changed_when: "mail_user_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mail_user_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_mail_server_ips'
block: |
# - Client Ports used by local Mail Services
# -
# - comma separated list
# -
mail_user_ports="$standard_mailuser_ports"
marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)"
when:
- main_ipv4_exists.stat.exists
- mail_user_ports_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'mail_user_ports=..' is present
shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv6.conf
register: mail_user_ports_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "mail_user_ports_ipv6_present.rc > 1"
changed_when: "mail_user_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mail_user_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_mail_server_ips'
block: |
# - Client Ports used by local Mail Services
# -
# - comma separated list
# -
mail_user_ports="$standard_mailuser_ports"
marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)"
when:
- main_ipv6_exists.stat.exists
- mail_user_ports_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# ftp_passive_port_range
# ---
- name: Check if String 'ftp_passive_port_range=..' is present
shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv4.conf
register: ftp_passive_port_range_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "ftp_passive_port_range_ipv4_present.rc > 1"
changed_when: "ftp_passive_port_range_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ftp_passive_port_range)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_ftp_server_ips'
block: |
# - FTP passive port range use by local ftp service(s)
# -
# - example: ftp_passive_port_range="50000:50400"
# -
ftp_passive_port_range="50000:50400"
marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)"
when:
- main_ipv4_exists.stat.exists
- ftp_passive_port_range_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'ftp_passive_port_range=..' is present
shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv6.conf
register: ftp_passive_port_range_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "ftp_passive_port_range_ipv6_present.rc > 1"
changed_when: "ftp_passive_port_range_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ftp_passive_port_range)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_ftp_server_ips'
block: |
# - FTP passive port range use by local ftp service(s)
# -
# - example: ftp_passive_port_range="50000:50400"
# -
ftp_passive_port_range="50000:50400"
marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)"
when:
- main_ipv6_exists.stat.exists
- ftp_passive_port_range_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# munin_remote_port
# ---
- name: Check if String 'munin_remote_port=..' is present
shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv4.conf
register: munin_remote_port_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "munin_remote_port_ipv4_present.rc > 1"
changed_when: "munin_remote_port_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (munin_remote_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_munin_server_ips'
block: |
# - Port used by clients hosted on this (local) Munin Services
# -
# - !! Only one port is possible !!
# -
munin_remote_port="$standard_munin_port"
marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)"
when:
- main_ipv4_exists.stat.exists
- munin_remote_port_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'munin_remote_port=..' is present
shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv6.conf
register: munin_remote_port_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "munin_remote_port_ipv6_present.rc > 1"
changed_when: "munin_remote_port_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (munin_remote_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_munin_server_ips'
block: |
# - Ports used by clients hosted on this (local) Munin Services
# -
# - !! Only one port is possible !!
# -
munin_remote_port="$standard_munin_port"
marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)"
when:
- main_ipv6_exists.stat.exists
- munin_remote_port_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# xymon_port
# ---
- name: Check if String 'xymon_port=..' is present
shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv4.conf
register: xymon_port_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "xymon_port_ipv4_present.rc > 1"
changed_when: "xymon_port_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (xymon_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*local_xymon_client'
block: |
# - Port used by local Xymon Services
# -
# - !! Only one port is possible !!
# -
xymon_port="$standard_xymon_port"
marker: "# Marker set by modify-ipt-server.yml (xymon_port)"
when:
- main_ipv4_exists.stat.exists
- xymon_port_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'xymon_port=..' is present
shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv6.conf
register: xymon_port_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "xymon_port_ipv6_present.rc > 1"
changed_when: "xymon_port_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (xymon_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*local_xymon_client'
block: |
# - Port used by local Xymon Services
# -
# - !! Only one port is possible !!
# -
xymon_port="$standard_xymon_port"
marker: "# Marker set by modify-ipt-server.yml (xymon_port)"
when:
- main_ipv6_exists.stat.exists
- xymon_port_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# mumble_ports
# ---
- name: Check if String 'mumble_ports=..' is present
shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv4.conf
register: mumble_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "mumble_ports_ipv4_present.rc > 1"
changed_when: "mumble_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mumble_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_mumble_server_ips'
block: |
# - Ports used by local Mumble Services
# -
# - comma separated list
# -
mumble_ports="$standard_mumble_port"
marker: "# Marker set by modify-ipt-server.yml (mumble_ports)"
when:
- main_ipv4_exists.stat.exists
- mumble_ports_ipv4_present is changed
notify:
- Restart IPv4 Firewall
- name: Check if String 'mumble_ports=..' is present
shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv6.conf
register: mumble_ports_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "mumble_ports_ipv6_present.rc > 1"
changed_when: "mumble_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mumble_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_mumble_server_ips'
block: |
# - Ports used by local Mumble Services
# -
# - comma separated list
# -
mumble_ports="$standard_mumble_port"
marker: "# Marker set by modify-ipt-server.yml (mumble_ports)"
when:
- main_ipv6_exists.stat.exists
- mumble_ports_ipv6_present is changed
notify:
- Restart IPv6 Firewall
# ---
# Remove Marker set by blockinfile
# ---
- name: Remove marker IPv4
replace :
path: /etc/ipt-firewall/main_ipv4.conf
regexp: "^# Marker set by modify-ipt-server.yml.*$"
replace: ""
register: marker_ipv4_removed
#failed_when: "marker_ipv4_removed.rc > 1"
#changed_when: "marker_ipv4_removed.rc < 1"
when:
- main_ipv4_exists.stat.exists
- name: Remove marker IPv6
replace :
path: /etc/ipt-firewall/main_ipv6.conf
regexp: "^# Marker set by modify-ipt-server.yml.*$"
replace: ""
register: marker_ipv6_removed
#failed_when: "marker_ipv6_removed.rc > 1"
#changed_when: "marker_ipv6_removed.rc < 1"
when:
- main_ipv6_exists.stat.exists
# ===
# Update/Modify firewall
# ===
# ---
# Host specific configuration files
# ---
# /etc/ipt-firewall/interfaces_ipv[4|6].conf
#
- name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv4.conf'
command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv4.conf.sample /etc/ipt-firewall/interfaces_ipv4.conf
when: not interfaces_ipv4_exists.stat.exists
register: new_interfaces_ipv4
notify:
- Restart IPv4 Firewall
- name: Configure interfaces_ipv4.conf 1/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv4.conf
regexp: '^ext_if_{{ idx + 1 }}='
line: 'ext_if_{{ idx + 1 }}="{{ item.device }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv4_exists.stat.exists
- new_interfaces_ipv4 is changed
- name: Configure interfaces_ipv4.conf 2/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv4.conf
regexp: '^ext_{{ idx + 1 }}_ip='
line: 'ext_{{ idx + 1 }}_ip="{{ item.ipv4.address }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv4_exists.stat.exists
- new_interfaces_ipv4 is changed
- name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv6.conf'
command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv6.conf.sample /etc/ipt-firewall/interfaces_ipv6.conf
when: not interfaces_ipv6_exists.stat.exists
register: new_interfaces_ipv6
notify:
- Restart IPv6 Firewall
- name: Configure interfaces_ipv6.conf 1/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv6.conf
regexp: '^ext_if_{{ idx + 1 }}='
line: 'ext_if_{{ idx + 1 }}="{{ item.device }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv6_exists.stat.exists
- new_interfaces_ipv6 is changed
- name: Configure interfaces_ipv4.conf 2/2
lineinfile:
path: /etc/ipt-firewall/interfaces_ipv6.conf
regexp: '^ext_{{ idx + 1 }}_ip='
line: 'ext_{{ idx + 1 }}_ip="{{ item.ipv6.0.address }}"'
loop: "{{ ansible_netdev }}"
loop_control:
label: "{{ item.device }}"
index_var: idx
when:
- not interfaces_ipv6_exists.stat.exists
- new_interfaces_ipv6 is changed
# /etc/ipt-firewall/ban_ipv[4|6].list
#
- name: Place new configuration file '/etc/ipt-firewall/ban_ipv4.list'
command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv4.list.sample /etc/ipt-firewall/ban_ipv4.list
when: not ban_ipv4_exists.stat.exists
- name: Place new configuration file '/etc/ipt-firewall/ban_ipv6.list'
command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv6.list.sample /etc/ipt-firewall/ban_ipv6.list
when: not ban_ipv6_exists.stat.exists
# /etc/ipt-firewall/main_ipv[4|6].conf
#
- name: Place new configuration file '/etc/ipt-firewall/main_ipv4.conf'
command: cp {{ git_firewall_repository.dest }}/conf/main_ipv4.conf.sample /etc/ipt-firewall/main_ipv4.conf
when: not main_ipv4_exists.stat.exists
register: cp_main_ipv4
notify:
- Restart IPv4 Firewall
- name: Place new configuration file '/etc/ipt-firewall/main_ipv6.conf'
command: cp {{ git_firewall_repository.dest }}/conf/main_ipv6.conf.sample /etc/ipt-firewall/main_ipv6.conf
when: not main_ipv6_exists.stat.exists
register: cp_main_ipv6
notify:
- Restart IPv6 Firewall
# Configure main_ipv4.conf
#
- name: Configure main_ipv4.conf (dns_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*dns_server_ips'
line: dns_server_ips="$ext_ips"
state: present
when:
- "groups['dns_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (ssh_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*ssh_server_ips'
line: ssh_server_ips="$ext_ips"
state: present
when:
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (http_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*http_server_ips='
line: http_server_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (mail_client_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*mail_client_ips='
line: mail_client_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (smtpd_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*smtpd_ips='
line: smtpd_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (mail_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*mail_server_ips='
line: mail_server_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (ftp_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*ftp_server_ips='
line: ftp_server_ips="$ext_1_ip"
state: present
when:
- "groups['ftp_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
- name: Configure main_ipv4.conf (mumble_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^\s*mumble_server_ips='
line: mumble_server_ips="$ext_1_ip"
state: present
when:
- "groups['mumble_server']|string is search(inventory_hostname)"
- not main_ipv4_exists.stat.exists
- cp_main_ipv4 is changed
# Configure main_ipv6.conf
#
- name: Configure main_ipv6.conf (dns_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*dns_server_ips'
line: dns_server_ips="$ext_ips"
state: present
when:
- "groups['dns_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (ssh_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*ssh_server_ips'
line: ssh_server_ips="$ext_ips"
state: present
when:
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (http_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*http_server_ips='
line: http_server_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (mail_client_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*mail_client_ips='
line: mail_client_ips="$ext_1_ip"
state: present
when:
- "groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nginx_webserver']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (smtpd_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*smtpd_ips='
line: smtpd_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (mail_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*mail_server_ips='
line: mail_server_ips="$ext_1_ip"
state: present
when:
- "groups['mail_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (ftp_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*ftp_server_ips='
line: ftp_server_ips="$ext_1_ip"
state: present
when:
- "groups['ftp_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
- name: Configure main_ipv6.conf (mumble_server_ips)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^\s*mumble_server_ips='
line: mumble_server_ips="$ext_1_ip"
state: present
when:
- "groups['mumble_server']|string is search(inventory_hostname)"
- not main_ipv6_exists.stat.exists
- cp_main_ipv6 is changed
# ---
# Host independet configuration files
# ---
- name: Check if common configuration files are latest
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
changed_when: "diff_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_output.rc > 2"
when: git_firewall_repository is defined and git_firewall_repository > 0
loop:
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- default_ports.conf
- post_decalrations.conf
register: diff_output
- name: Ensure common configuration files are latest
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
loop:
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- default_ports.conf
- post_decalrations.conf
when:
- git_firewall_repository is defined and git_firewall_repository > 0
- diff_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
# ---
# Firewall scripts
# ---
- name: Check if firewall scripts are latest
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
changed_when: "diff_script_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_script_output.rc > 2"
when: git_firewall_repository is defined and git_firewall_repository > 0
loop:
- ipt-firewall-server
- ip6t-firewall-server
register: diff_script_output
- name: Ensure firewall scripts are latest
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
loop:
- ipt-firewall-server
- ip6t-firewall-server
when:
- git_firewall_repository is defined and git_firewall_repository > 0
- diff_script_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
handlers:
- name: Restart ulogd
service:
name: ulogd
state: restarted
- name: Restart IPv4 Firewall
service:
name: ipt-firewall
state: restarted
- name: Restart IPv6 Firewall
service:
name: ip6t-firewall
state: restarted

441
scripts/modify-ipt-server.yml Normal file
View File

@ -0,0 +1,441 @@
---
- hosts: all
tasks:
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv6.conf
register: main_ipv4_exists
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv4.conf
register: main_ipv6_exists
# ---
# vpn_ports
# ---
- name: Check if String 'vpn_ports=..' is present
shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv4.conf
register: vpn_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "vpn_ports_ipv4_present.rc > 1"
changed_when: "vpn_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (vpn_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_vpn_server_ips'
block: |
# - VPN Port(s) used by local Services
# -
# - blank separated list
# -
vpn_ports="$standard_vpn_port"
marker: "# Marker set by modify-ipt-server.yml (vpn_ports)"
when:
- main_ipv4_exists.stat.exists
- vpn_ports_ipv4_present is changed
- name: Check if String 'vpn_ports=..' is present
shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv6.conf
register: vpn_ports_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "vpn_ports_ipv6_present.rc > 1"
changed_when: "vpn_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (vpn_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_vpn_server_ips'
block: |
# - VPN Port(s) used by local Services
# -
# - blank separated list
# -
vpn_ports="$standard_vpn_port"
marker: "# Marker set by modify-ipt-server.yml (vpn_ports)"
when:
- main_ipv6_exists.stat.exists
- vpn_ports_ipv6_present is changed
# ---
# ssh_ports
# ---
- name: Check if String 'ssh_ports=..' is present
shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv4.conf
register: ssh_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "ssh_ports_ipv4_present.rc > 1"
changed_when: "ssh_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ssh_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_ssh_server_ips'
block: |
# - SSH Port(s) used by local Services
# -
# - blank separated list
# -
ssh_ports="$standard_ssh_port"
marker: "# Marker set by modify-ipt-server.yml (ssh_ports)"
when:
- main_ipv4_exists.stat.exists
- ssh_ports_ipv4_present is changed
- name: Check if String 'ssh_ports=..' is present
shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv6.conf
register: ssh_ports_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "ssh_ports_ipv6_present.rc > 1"
changed_when: "ssh_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ssh_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_ssh_server_ips'
block: |
# - SSH Port(s) used by local Services
# -
# - blank separated list
# -
ssh_ports="$standard_ssh_port"
marker: "# Marker set by modify-ipt-server.yml (ssh_ports)"
when:
- main_ipv6_exists.stat.exists
- ssh_ports_ipv6_present is changed
# ---
# http_ports
# ---
- name: Check if String 'http_ports=..' is present
shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv4.conf
register: http_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "http_ports_ipv4_present.rc > 1"
changed_when: "http_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (http_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_http_server_ips'
block: |
# - HTTP(S) Ports used by local Services
# -
# - comma separated list
# -
http_ports="$standard_http_ports"
marker: "# Marker set by modify-ipt-server.yml (http_ports)"
when:
- main_ipv4_exists.stat.exists
- http_ports_ipv4_present is changed
- name: Check if String 'http_ports=..' is present
shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv6.conf
register: http_ports_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "http_ports_ipv6_present.rc > 1"
changed_when: "http_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (http_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_http_server_ips'
block: |
# - HTTP(S) Ports used by local Services
# -
# - comma separated list
# -
http_ports="$standard_http_ports"
marker: "# Marker set by modify-ipt-server.yml (http_ports)"
when:
- main_ipv6_exists.stat.exists
- http_ports_ipv6_present is changed
# ---
# mail_user_ports
# ---
- name: Check if String 'mail_user_ports=..' is present
shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv4.conf
register: mail_user_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "mail_user_ports_ipv4_present.rc > 1"
changed_when: "mail_user_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mail_user_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_mail_server_ips'
block: |
# - Client Ports used by local Mail Services
# -
# - comma separated list
# -
mail_user_ports="$standard_mailuser_ports"
marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)"
when:
- main_ipv4_exists.stat.exists
- mail_user_ports_ipv4_present is changed
- name: Check if String 'mail_user_ports=..' is present
shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv6.conf
register: mail_user_ports_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "mail_user_ports_ipv6_present.rc > 1"
changed_when: "mail_user_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mail_user_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_mail_server_ips'
block: |
# - Client Ports used by local Mail Services
# -
# - comma separated list
# -
mail_user_ports="$standard_mailuser_ports"
marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)"
when:
- main_ipv6_exists.stat.exists
- mail_user_ports_ipv6_present is changed
# ---
# ftp_passive_port_range
# ---
- name: Check if String 'ftp_passive_port_range=..' is present
shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv4.conf
register: ftp_passive_port_range_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "ftp_passive_port_range_ipv4_present.rc > 1"
changed_when: "ftp_passive_port_range_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ftp_passive_port_range)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_ftp_server_ips'
block: |
# - FTP passive port range use by local ftp service(s)
# -
# - example: ftp_passive_port_range="50000:50400"
# -
ftp_passive_port_range="50000:50400"
marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)"
when:
- main_ipv4_exists.stat.exists
- ftp_passive_port_range_ipv4_present is changed
- name: Check if String 'ftp_passive_port_range=..' is present
shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv6.conf
register: ftp_passive_port_range_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "ftp_passive_port_range_ipv6_present.rc > 1"
changed_when: "ftp_passive_port_range_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ftp_passive_port_range)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_ftp_server_ips'
block: |
# - FTP passive port range use by local ftp service(s)
# -
# - example: ftp_passive_port_range="50000:50400"
# -
ftp_passive_port_range="50000:50400"
marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)"
when:
- main_ipv6_exists.stat.exists
- ftp_passive_port_range_ipv6_present is changed
# ---
# munin_remote_port
# ---
- name: Check if String 'munin_remote_port=..' is present
shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv4.conf
register: munin_remote_port_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "munin_remote_port_ipv4_present.rc > 1"
changed_when: "munin_remote_port_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (munin_remote_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_munin_server_ips'
block: |
# - Port used by clients hosted on this (local) Munin Services
# -
# - !! Only one port is possible !!
# -
munin_remote_port="$standard_munin_port"
marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)"
when:
- main_ipv4_exists.stat.exists
- munin_remote_port_ipv4_present is changed
- name: Check if String 'munin_remote_port=..' is present
shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv6.conf
register: munin_remote_port_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "munin_remote_port_ipv6_present.rc > 1"
changed_when: "munin_remote_port_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (munin_remote_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_munin_server_ips'
block: |
# - Ports used by clients hosted on this (local) Munin Services
# -
# - !! Only one port is possible !!
# -
munin_remote_port="$standard_munin_port"
marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)"
when:
- main_ipv6_exists.stat.exists
- munin_remote_port_ipv6_present is changed
# ---
# xymon_port
# ---
- name: Check if String 'xymon_port=..' is present
shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv4.conf
register: xymon_port_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "xymon_port_ipv4_present.rc > 1"
changed_when: "xymon_port_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (xymon_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*local_xymon_client'
block: |
# - Port used by local Xymon Services
# -
# - !! Only one port is possible !!
# -
xymon_port="$standard_xymon_port"
marker: "# Marker set by modify-ipt-server.yml (xymon_port)"
when:
- main_ipv4_exists.stat.exists
- xymon_port_ipv4_present is changed
- name: Check if String 'xymon_port=..' is present
shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv6.conf
register: xymon_port_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "xymon_port_ipv6_present.rc > 1"
changed_when: "xymon_port_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (xymon_port)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*local_xymon_client'
block: |
# - Port used by local Xymon Services
# -
# - !! Only one port is possible !!
# -
xymon_port="$standard_xymon_port"
marker: "# Marker set by modify-ipt-server.yml (xymon_port)"
when:
- main_ipv6_exists.stat.exists
- xymon_port_ipv6_present is changed
# ---
# mumble_ports
# ---
- name: Check if String 'mumble_ports=..' is present
shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv4.conf
register: mumble_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "mumble_ports_ipv4_present.rc > 1"
changed_when: "mumble_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mumble_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*forward_mumble_server_ips'
block: |
# - Ports used by local Mumble Services
# -
# - comma separated list
# -
mumble_ports="$standard_mumble_port"
marker: "# Marker set by modify-ipt-server.yml (mumble_ports)"
when:
- main_ipv4_exists.stat.exists
- mumble_ports_ipv4_present is changed
- name: Check if String 'mumble_ports=..' is present
shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv6.conf
register: mumble_ports_ipv6_present
when: main_ipv4_exists.stat.exists
failed_when: "mumble_ports_ipv6_present.rc > 1"
changed_when: "mumble_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mumble_ports)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*forward_mumble_server_ips'
block: |
# - Ports used by local Mumble Services
# -
# - comma separated list
# -
mumble_ports="$standard_mumble_port"
marker: "# Marker set by modify-ipt-server.yml (mumble_ports)"
when:
- main_ipv6_exists.stat.exists
- mumble_ports_ipv6_present is changed
# ---
# Remove Marker set by blockinfile
# ---
- name: Remove marker IPv4
replace :
path: /etc/ipt-firewall/main_ipv4.conf
regexp: "^# Marker set by modify-ipt-server.yml.*$"
replace: ""
register: marker_ipv4_removed
#failed_when: "marker_ipv4_removed.rc > 1"
#changed_when: "marker_ipv4_removed.rc < 1"
when:
- main_ipv4_exists.stat.exists
- name: Remove marker IPv6
replace :
path: /etc/ipt-firewall/main_ipv6.conf
regexp: "^# Marker set by modify-ipt-server.yml.*$"
replace: ""
register: marker_ipv6_removed
#failed_when: "marker_ipv6_removed.rc > 1"
#changed_when: "marker_ipv6_removed.rc < 1"
when:
- main_ipv6_exists.stat.exists

28
scripts/test.yml
View File

@ -1,19 +1,19 @@
---
- hosts: o25.oopen.de
- hosts: all
tasks:
- name: debug print all interface ipv4 data
when: "hostvars[ansible_fqdn]['ansible_'~item]['ipv4'] is defined"
debug:
msg="{{ hostvars[ansible_fqdn]['ansible_'~item]['ipv4'] | pprint }}"
with_items:
- "{{ ansible_interfaces | map('replace', '-','_') | list }}"
- name: define traditional ethernet facts
- name: Get sshd ports as blank separated list
set_fact:
ansible_eth: "{% set ansible_eth = ansible_eth|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_eth|list }}"
when: hostvars[inventory_hostname]['ansible_' + item]['type'] == 'ether'
with_items:
- "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}"
fw_sshd_ports: "{{ sshd_ports | join (' ') }}"
when:
- sshd_ports is defined and sshd_ports | length > 0
- sshd_ports|join() != "22"
- name: Set default sshd ports
set_fact:
fw_sshd_ports: "$standard_ssh_port"
when:
- sshd_ports is not defined or sshd_ports | length == 0 or sshd_ports|join() == "22"