host_firewall: ban firehol level2, bruteforceblocker, vxvault and cybercrime; greensnow is part of level2
This commit is contained in:
@@ -59,7 +59,7 @@
|
||||
src: "{{ item }}"
|
||||
dest: "/etc/systemd/system/{{ item }}"
|
||||
mode: "0644"
|
||||
loop: [nft-host.service, nft-host-geo.service, nft-host-geo.timer, nft-host-spamhaus.service, nft-host-spamhaus.timer, nft-host-firehol.service, nft-host-firehol.timer, nft-host-scanners.service, nft-host-scanners.timer, nft-host-greensnow.service, nft-host-greensnow.timer]
|
||||
loop: [nft-host.service, nft-host-geo.service, nft-host-geo.timer, nft-host-spamhaus.service, nft-host-spamhaus.timer, nft-host-firehol.service, nft-host-firehol.timer, nft-host-scanners.service, nft-host-scanners.timer]
|
||||
register: firewall_units
|
||||
|
||||
- name: Install the rollback script
|
||||
@@ -174,7 +174,7 @@
|
||||
path: /etc/nftables.d/host-spamhaus.nft
|
||||
state: absent
|
||||
|
||||
- name: FireHOL set
|
||||
- name: FireHOL sets
|
||||
when: firewall.firehol
|
||||
block:
|
||||
- name: Install the FireHOL set updater
|
||||
@@ -183,25 +183,31 @@
|
||||
dest: /usr/local/sbin/nft-host-firehol
|
||||
mode: "0755"
|
||||
|
||||
# The rule set includes this file, so a missing one would fail the load at boot.
|
||||
- name: Build the FireHOL set on first run
|
||||
ansible.builtin.command: /usr/local/sbin/nft-host-firehol
|
||||
args:
|
||||
creates: /etc/nftables.d/host-firehol.nft
|
||||
# The rule set includes this file and uses all of its sets, so a missing file or set would fail the load at boot.
|
||||
- name: Look for the FireHOL sets
|
||||
ansible.builtin.command: grep -cE 'set (firehol_v4|firehol_level2_v4|bruteforceblocker_v4|malware_v4) ' /etc/nftables.d/host-firehol.nft
|
||||
register: firewall_firehol_sets
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
|
||||
- name: Read the FireHOL set file
|
||||
- name: Build the FireHOL sets when missing
|
||||
ansible.builtin.command: /usr/local/sbin/nft-host-firehol
|
||||
when: firewall_firehol_sets.stdout != '4'
|
||||
|
||||
- name: Read the FireHOL sets file
|
||||
ansible.builtin.stat:
|
||||
path: /etc/nftables.d/host-firehol.nft
|
||||
register: firewall_firehol
|
||||
|
||||
- name: Require non-empty FireHOL set
|
||||
- name: Require non-empty FireHOL sets
|
||||
ansible.builtin.assert:
|
||||
that: firewall_firehol.stat.exists and firewall_firehol.stat.size > 0
|
||||
fail_msg: /etc/nftables.d/host-firehol.nft is missing or empty, refusing to apply the firewall
|
||||
# Check mode neither installs the updater nor builds the sets.
|
||||
when: not ansible_check_mode
|
||||
|
||||
- name: Enable the FireHOL set timer
|
||||
- name: Enable the FireHOL sets timer
|
||||
ansible.builtin.systemd:
|
||||
name: nft-host-firehol.timer
|
||||
enabled: true
|
||||
@@ -210,10 +216,10 @@
|
||||
# Check mode does not install the unit.
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
|
||||
- name: Stop the FireHOL set refresh
|
||||
- name: Stop the FireHOL sets refresh
|
||||
when: not firewall.firehol
|
||||
block:
|
||||
- name: Disable the FireHOL set timer
|
||||
- name: Disable the FireHOL sets timer
|
||||
ansible.builtin.systemd:
|
||||
name: nft-host-firehol.timer
|
||||
enabled: false
|
||||
@@ -222,7 +228,7 @@
|
||||
# Check mode does not install the unit.
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
|
||||
- name: Remove the FireHOL set file
|
||||
- name: Remove the FireHOL sets file
|
||||
ansible.builtin.file:
|
||||
path: /etc/nftables.d/host-firehol.nft
|
||||
state: absent
|
||||
@@ -287,59 +293,6 @@
|
||||
path: /etc/nftables.d/host-scanners.nft
|
||||
state: absent
|
||||
|
||||
- name: GreenSnow set
|
||||
when: firewall.greensnow
|
||||
block:
|
||||
- name: Install the GreenSnow set updater
|
||||
ansible.builtin.copy:
|
||||
src: nft-host-greensnow
|
||||
dest: /usr/local/sbin/nft-host-greensnow
|
||||
mode: "0755"
|
||||
|
||||
# The rule set includes this file, so a missing one would fail the load at boot.
|
||||
- name: Build the GreenSnow set on first run
|
||||
ansible.builtin.command: /usr/local/sbin/nft-host-greensnow
|
||||
args:
|
||||
creates: /etc/nftables.d/host-greensnow.nft
|
||||
|
||||
- name: Read the GreenSnow set file
|
||||
ansible.builtin.stat:
|
||||
path: /etc/nftables.d/host-greensnow.nft
|
||||
register: firewall_greensnow
|
||||
|
||||
- name: Require non-empty GreenSnow set
|
||||
ansible.builtin.assert:
|
||||
that: firewall_greensnow.stat.exists and firewall_greensnow.stat.size > 0
|
||||
fail_msg: /etc/nftables.d/host-greensnow.nft is missing or empty, refusing to apply the firewall
|
||||
# Check mode neither installs the updater nor builds the set.
|
||||
when: not ansible_check_mode
|
||||
|
||||
- name: Enable the GreenSnow set timer
|
||||
ansible.builtin.systemd:
|
||||
name: nft-host-greensnow.timer
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: "{{ firewall_units is changed }}"
|
||||
# Check mode does not install the unit.
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
|
||||
- name: Stop the GreenSnow set refresh
|
||||
when: not firewall.greensnow
|
||||
block:
|
||||
- name: Disable the GreenSnow set timer
|
||||
ansible.builtin.systemd:
|
||||
name: nft-host-greensnow.timer
|
||||
enabled: false
|
||||
state: stopped
|
||||
daemon_reload: "{{ firewall_units is changed }}"
|
||||
# Check mode does not install the unit.
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
|
||||
- name: Remove the GreenSnow set file
|
||||
ansible.builtin.file:
|
||||
path: /etc/nftables.d/host-greensnow.nft
|
||||
state: absent
|
||||
|
||||
- name: Render the rule set
|
||||
ansible.builtin.template:
|
||||
src: host.nft.j2
|
||||
@@ -414,3 +367,36 @@
|
||||
dest: /etc/nftables.d/host.nft.good
|
||||
remote_src: true
|
||||
mode: "0644"
|
||||
|
||||
# GreenSnow is part of FireHOL level2. The rule file goes last: the last confirmed rule set (host.nft.good) and a
|
||||
# reload by a refresh service still include it until the new rule set is confirmed. The set itself leaves the live
|
||||
# table with the reload of the new rule set.
|
||||
- name: Look for the GreenSnow timer
|
||||
ansible.builtin.stat:
|
||||
path: /etc/systemd/system/nft-host-greensnow.timer
|
||||
register: firewall_greensnow_timer
|
||||
|
||||
- name: Stop the GreenSnow refresh
|
||||
ansible.builtin.systemd:
|
||||
name: nft-host-greensnow.timer
|
||||
enabled: false
|
||||
state: stopped
|
||||
when: firewall_greensnow_timer.stat.exists
|
||||
# Check mode does not stop the timer.
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
|
||||
- name: Remove the GreenSnow files
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /etc/systemd/system/nft-host-greensnow.service
|
||||
- /etc/systemd/system/nft-host-greensnow.timer
|
||||
- /usr/local/sbin/nft-host-greensnow
|
||||
- /etc/nftables.d/host-greensnow.nft
|
||||
register: firewall_greensnow_files
|
||||
|
||||
- name: Reload systemd after removing the GreenSnow units
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
when: firewall_greensnow_files is changed
|
||||
|
||||
Reference in New Issue
Block a user