diff options
| -rw-r--r-- | manifests/subsystems/firewall.pp | 14 | ||||
| -rw-r--r-- | manifests/subsystems/monitor.pp | 2 |
2 files changed, 4 insertions, 12 deletions
diff --git a/manifests/subsystems/firewall.pp b/manifests/subsystems/firewall.pp index a43662f..130e638 100644 --- a/manifests/subsystems/firewall.pp +++ b/manifests/subsystems/firewall.pp @@ -2,16 +2,6 @@ class firewall { class { 'shorewall': } - # SSL computational DoS mitigation - # See http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html - $firewall_ssl_ratelimit = $firewall_ssl_ratelimit ? { - '' => $firewall_global_ssl_ratelimit ? { - '' => '-', - default => $firewall_global_ssl_ratelimit, - }, - default => $firewall_ssl_ratelimit, - } - $rfc1918 = $shorewall_local_net ? { true => true, false => false, @@ -120,13 +110,15 @@ class firewall { order => 102, } + # SSL computational DoS mitigation + # See http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html shorewall::rule { 'https': action => 'HTTPS/ACCEPT', source => 'net', destination => '$FW', proto => '-', destinationport => '-', - ratelimit => "$firewall_ssl_ratelimit", + ratelimit => extlookup("firewall_ssl_ratelimit", '-'), order => 103, } diff --git a/manifests/subsystems/monitor.pp b/manifests/subsystems/monitor.pp index 5be3509..2e59838 100644 --- a/manifests/subsystems/monitor.pp +++ b/manifests/subsystems/monitor.pp @@ -7,7 +7,7 @@ class monitor( if $type == 'vserver' { include nagios::target::fqdn - nagios::service::ping { "$fqdn": } + nagios::service::ping { "$fqdn": } } if $type == 'host' or $type == 'personal' { |