diff options
| author | Silvio Rhatto <rhatto@riseup.net> | 2015-07-31 16:07:29 -0300 |
|---|---|---|
| committer | Silvio Rhatto <rhatto@riseup.net> | 2015-07-31 16:07:29 -0300 |
| commit | 8a4fbfa8a071094e5727f4e49107c0cfe79e9c45 (patch) | |
| tree | a793668c3a2be7538630976551be4d642c49cce0 /manifests/subsystem | |
| parent | e55feae3bc42fb6c17b402eb1685d393ea94d573 (diff) | |
| parent | f057008d9c07f5f15de1b65ca9bd7c63d37c2db8 (diff) | |
| download | puppet-nodo-8a4fbfa8a071094e5727f4e49107c0cfe79e9c45.tar.gz puppet-nodo-8a4fbfa8a071094e5727f4e49107c0cfe79e9c45.tar.bz2 | |
Merge branch 'master' into develop
Diffstat (limited to 'manifests/subsystem')
| -rw-r--r-- | manifests/subsystem/sysctl.pp | 2 | ||||
| -rw-r--r-- | manifests/subsystem/sysctl/disable_ipv6.pp | 19 |
2 files changed, 21 insertions, 0 deletions
diff --git a/manifests/subsystem/sysctl.pp b/manifests/subsystem/sysctl.pp index 03e1683..94fbae0 100644 --- a/manifests/subsystem/sysctl.pp +++ b/manifests/subsystem/sysctl.pp @@ -1,4 +1,6 @@ class nodo::subsystem::sysctl { + class { 'nodo::subsystem::sysctl::disable_ipv6': } + # Root exploit fix, see http://wiki.debian.org/mmap_min_addr # Maybe this can be remove in the future or included in a sysctl puppet module file { "/etc/sysctl.d/mmap_min_addr.conf": diff --git a/manifests/subsystem/sysctl/disable_ipv6.pp b/manifests/subsystem/sysctl/disable_ipv6.pp new file mode 100644 index 0000000..a6486a0 --- /dev/null +++ b/manifests/subsystem/sysctl/disable_ipv6.pp @@ -0,0 +1,19 @@ +# Do not enable ipv6 by default +# See https://wiki.debian.org/DebianIPv6 +class nodo::subsystem::sysctl::disable_ipv6( + $ensure = hiera('nodo::sysctl::disable_ipv6', 'present'), +) { + file { "/etc/sysctl.d/disable_ipv6.conf": + owner => "root", + group => "root", + mode => 0644, + ensure => $ensure, + source => "puppet:///modules/nodo/etc/sysctl.d/disable_ipv6.conf", + } + + exec { "sysctl-disable-ipv6": + command => '/sbin/sysctl -p', + subscribe => File["/etc/sysctl.d/disable_ipv6.conf"], + refreshonly => true, + } +} |