diff options
| author | Silvio Rhatto <rhatto@riseup.net> | 2015-07-31 16:05:20 -0300 |
|---|---|---|
| committer | Silvio Rhatto <rhatto@riseup.net> | 2015-07-31 16:05:20 -0300 |
| commit | f057008d9c07f5f15de1b65ca9bd7c63d37c2db8 (patch) | |
| tree | 8e0fec94d58ed0da6af30c3c105b31634b20465d /manifests/subsystem | |
| parent | 7f857de9d2e5ca739cd71b5c571e1f6fa01d4457 (diff) | |
| download | puppet-nodo-f057008d9c07f5f15de1b65ca9bd7c63d37c2db8.tar.gz puppet-nodo-f057008d9c07f5f15de1b65ca9bd7c63d37c2db8.tar.bz2 | |
Adds nodo::subsystem::sysctl::disable_ipv6
Diffstat (limited to 'manifests/subsystem')
| -rw-r--r-- | manifests/subsystem/sysctl.pp | 2 | ||||
| -rw-r--r-- | manifests/subsystem/sysctl/disable_ipv6.pp | 19 |
2 files changed, 21 insertions, 0 deletions
diff --git a/manifests/subsystem/sysctl.pp b/manifests/subsystem/sysctl.pp index 03e1683..94fbae0 100644 --- a/manifests/subsystem/sysctl.pp +++ b/manifests/subsystem/sysctl.pp @@ -1,4 +1,6 @@ class nodo::subsystem::sysctl { + class { 'nodo::subsystem::sysctl::disable_ipv6': } + # Root exploit fix, see http://wiki.debian.org/mmap_min_addr # Maybe this can be remove in the future or included in a sysctl puppet module file { "/etc/sysctl.d/mmap_min_addr.conf": diff --git a/manifests/subsystem/sysctl/disable_ipv6.pp b/manifests/subsystem/sysctl/disable_ipv6.pp new file mode 100644 index 0000000..a6486a0 --- /dev/null +++ b/manifests/subsystem/sysctl/disable_ipv6.pp @@ -0,0 +1,19 @@ +# Do not enable ipv6 by default +# See https://wiki.debian.org/DebianIPv6 +class nodo::subsystem::sysctl::disable_ipv6( + $ensure = hiera('nodo::sysctl::disable_ipv6', 'present'), +) { + file { "/etc/sysctl.d/disable_ipv6.conf": + owner => "root", + group => "root", + mode => 0644, + ensure => $ensure, + source => "puppet:///modules/nodo/etc/sysctl.d/disable_ipv6.conf", + } + + exec { "sysctl-disable-ipv6": + command => '/sbin/sysctl -p', + subscribe => File["/etc/sysctl.d/disable_ipv6.conf"], + refreshonly => true, + } +} |