From 2750d6e46796b79d685bbc068f9bda94797641f8 Mon Sep 17 00:00:00 2001 From: fitz123 Date: Fri, 20 May 2016 03:35:12 +0700 Subject: [PATCH 1/5] integrate ufw defaults management --- defaults/main.yml | 11 +++++++++++ tasks/sysctl.yml | 5 +++++ templates/ufw.j2 | 44 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 60 insertions(+) create mode 100644 templates/ufw.j2 diff --git a/defaults/main.yml b/defaults/main.yml index 74145a0e..bf5d1d22 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -40,6 +40,17 @@ os_security_init_prompt: true # Require root password for single user mode. (rhel, centos) os_security_init_single: false +# Apply ufw defaults +ufw_manage_defaults: true + +# Disable IPT_SYSCTL in /etc/default/ufw +ufw_ipt_sysctl: '' + +# Default ufw policies +ufw_default_input_policy: 'DROP' +ufw_default_output_policy: 'ACCEPT' +ufw_default_forward_policy: 'DROP' + # CAUTION # If you want to overwrite sysctl-variables, # you have to overwrite the *whole* dict, or else only the single overwritten will be actually used. diff --git a/tasks/sysctl.yml b/tasks/sysctl.yml index 3f9344ce..8307879e 100644 --- a/tasks/sysctl.yml +++ b/tasks/sysctl.yml @@ -35,3 +35,8 @@ ignoreerrors: yes with_dict: '{{ sysctl_rhel_config }}' when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS' + +- name: Apply ufw defaults + template: src="ufw.j2" dest=/etc/default/ufw + when: ufw_manage_defaults and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') + tags: dev diff --git a/templates/ufw.j2 b/templates/ufw.j2 new file mode 100644 index 00000000..b6e1082e --- /dev/null +++ b/templates/ufw.j2 @@ -0,0 +1,44 @@ +# /etc/default/ufw +# + +# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback +# accepted). You will need to 'disable' and then 'enable' the firewall for +# the changes to take affect. +IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] == 1 else 'yes' }} + +# Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if +# you change this you will most likely want to adjust your rules. +DEFAULT_INPUT_POLICY="{{ ufw_default_input_policy }}" + +# Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if +# you change this you will most likely want to adjust your rules. +DEFAULT_OUTPUT_POLICY="{{ ufw_default_output_policy }}" + +# Set the default forward policy to ACCEPT, DROP or REJECT. Please note that +# if you change this you will most likely want to adjust your rules +DEFAULT_FORWARD_POLICY="{{ ufw_default_forward_policy }}" + +# Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please +# note that setting this to ACCEPT may be a security risk. See 'man ufw' for +# details +DEFAULT_APPLICATION_POLICY="{{ ufw_default_application_policy | default('SKIP') }}" + +# By default, ufw only touches its own chains. Set this to 'yes' to have ufw +# manage the built-in chains too. Warning: setting this to 'yes' will break +# non-ufw managed firewall rules +MANAGE_BUILTINS="{{ ufw_manage_builtins | default('no') }}" + +# +# IPT backend +# +# only enable if using iptables backend and want to overwrite /etc/sysctl.conf +{% if ufw_ipt_sysctl == '' %}#{% endif %}IPT_SYSCTL={{ ufw_ipt_sysctl }} + +# Extra connection tracking modules to load. Complete list can be found in +# net/netfilter/Kconfig of your kernel source. Some common modules: +# nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support +# nf_conntrack_netbios_ns: NetBIOS (samba) client support +# nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT +# nf_conntrack_ftp, nf_nat_ftp: active FTP support +# nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side) +IPT_MODULES="{{ ufw_ipt_modules | default('nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns') }}" From e34775bdaa45339769db64d996914bf1f887e6c2 Mon Sep 17 00:00:00 2001 From: fitz123 Date: Fri, 20 May 2016 03:35:43 +0700 Subject: [PATCH 2/5] ufw_manage_defaults README --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index 1a273d2d..84275fe0 100644 --- a/README.md +++ b/README.md @@ -51,6 +51,11 @@ It will not: * `os_security_suid_sgid_whitelist: []` - a list of paths which should not have their SUID/SGID bits altered * `os_security_suid_sgid_remove_from_unknown: false` - true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`. * `os_security_packages_clean': true` - removes packages with known issues. See section packages. +* `ufw_manage_defaults` - true means apply all settings with ufw_ prefix +* `ufw_ipt_sysctl` - by default it disables IPT_SYSCTL in /etc/default/ufw. If you want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl dictionary, for example: /etc/ufw/sysctl.conf. +* `ufw_default_input_policy` - DROP +* `ufw_default_output_policy` - ACCEPT +* `ufw_default_forward_policy` - DROP ## Packages From 08da4091c22b42ea4e30acc3f14cb9ca2d69a34f Mon Sep 17 00:00:00 2001 From: fitz123 Date: Sat, 21 May 2016 12:17:06 +0700 Subject: [PATCH 3/5] tag for ufw task changed to 'ufw' --- tasks/sysctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/sysctl.yml b/tasks/sysctl.yml index 8307879e..81948443 100644 --- a/tasks/sysctl.yml +++ b/tasks/sysctl.yml @@ -39,4 +39,4 @@ - name: Apply ufw defaults template: src="ufw.j2" dest=/etc/default/ufw when: ufw_manage_defaults and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') - tags: dev + tags: ufw From 0f8937c9b085e2d9bb8638569c5184b42c011c4c Mon Sep 17 00:00:00 2001 From: fitz123 Date: Sat, 21 May 2016 12:17:39 +0700 Subject: [PATCH 4/5] all ufw variables included into defaults file --- defaults/main.yml | 10 ++++++++-- templates/ufw.j2 | 6 +++--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index bf5d1d22..24d8f504 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -43,13 +43,19 @@ os_security_init_single: false # Apply ufw defaults ufw_manage_defaults: true -# Disable IPT_SYSCTL in /etc/default/ufw +# Empty variable disables IPT_SYSCTL in /etc/default/ufw +# by default in Ubuntu it set to: /etc/ufw/sysctl.conf +# CAUTION +# if you enable it - it'll overwrite /etc/sysctl.conf file, managed by hardening framework ufw_ipt_sysctl: '' -# Default ufw policies +# Default ufw variables ufw_default_input_policy: 'DROP' ufw_default_output_policy: 'ACCEPT' ufw_default_forward_policy: 'DROP' +ufw_default_application_policy: 'SKIP' +ufw_manage_builtins: 'no' +ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns' # CAUTION # If you want to overwrite sysctl-variables, diff --git a/templates/ufw.j2 b/templates/ufw.j2 index b6e1082e..d77be6e9 100644 --- a/templates/ufw.j2 +++ b/templates/ufw.j2 @@ -21,12 +21,12 @@ DEFAULT_FORWARD_POLICY="{{ ufw_default_forward_policy }}" # Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please # note that setting this to ACCEPT may be a security risk. See 'man ufw' for # details -DEFAULT_APPLICATION_POLICY="{{ ufw_default_application_policy | default('SKIP') }}" +DEFAULT_APPLICATION_POLICY="{{ ufw_default_application_policy }}" # By default, ufw only touches its own chains. Set this to 'yes' to have ufw # manage the built-in chains too. Warning: setting this to 'yes' will break # non-ufw managed firewall rules -MANAGE_BUILTINS="{{ ufw_manage_builtins | default('no') }}" +MANAGE_BUILTINS="{{ ufw_manage_builtins }}" # # IPT backend @@ -41,4 +41,4 @@ MANAGE_BUILTINS="{{ ufw_manage_builtins | default('no') }}" # nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT # nf_conntrack_ftp, nf_nat_ftp: active FTP support # nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side) -IPT_MODULES="{{ ufw_ipt_modules | default('nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns') }}" +IPT_MODULES="{{ ufw_ipt_modules }}" From 2f7a97fbc761bab2be8bd2da4b9929a725e011db Mon Sep 17 00:00:00 2001 From: fitz123 Date: Sat, 21 May 2016 12:42:16 +0700 Subject: [PATCH 5/5] fix task fail in case 'net.ipv6.conf.all.disable_ipv6' is not defined in sysctl_config dict --- templates/ufw.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/ufw.j2 b/templates/ufw.j2 index d77be6e9..60434654 100644 --- a/templates/ufw.j2 +++ b/templates/ufw.j2 @@ -4,7 +4,7 @@ # Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback # accepted). You will need to 'disable' and then 'enable' the firewall for # the changes to take affect. -IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] == 1 else 'yes' }} +IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] is defined and sysctl_config['net.ipv6.conf.all.disable_ipv6'] == 1 else 'yes' }} # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if # you change this you will most likely want to adjust your rules.