aboutsummaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
authormh <mh@immerda.ch>2009-09-29 20:11:52 +0200
committerMicah Anderson <micah@riseup.net>2009-12-07 11:34:11 -0500
commitfb82fa42e3c61c6adce3da457d1a4e15208b0683 (patch)
treee4b142efacf41d039866f09d814020458d6bfe16 /manifests
parent05dca56e4a139f273094a49dd2078b65ae474457 (diff)
downloadpuppet-shorewall-fb82fa42e3c61c6adce3da457d1a4e15208b0683.tar.gz
puppet-shorewall-fb82fa42e3c61c6adce3da457d1a4e15208b0683.tar.bz2
improve rule handling possiblities
they can now be set to absent as well introduce 2 outgoing ssh rules to either disable or remove the entry at all
Diffstat (limited to 'manifests')
-rw-r--r--manifests/entry.pp2
-rw-r--r--manifests/rule.pp2
-rw-r--r--manifests/rules/out/ssh/disable.pp5
-rw-r--r--manifests/rules/out/ssh/remove.pp5
4 files changed, 14 insertions, 0 deletions
diff --git a/manifests/entry.pp b/manifests/entry.pp
index bd59a88..4e639bc 100644
--- a/manifests/entry.pp
+++ b/manifests/entry.pp
@@ -1,9 +1,11 @@
define shorewall::entry(
+ $ensure = present,
$line
){
$target = "/var/lib/puppet/modules/shorewall/${name}"
$dir = dirname($target)
file { $target:
+ ensure => $ensure,
content => "${line}\n",
mode => 0600, owner => root, group => 0,
notify => Exec["concat_${dir}"],
diff --git a/manifests/rule.pp b/manifests/rule.pp
index 0614e95..8394970 100644
--- a/manifests/rule.pp
+++ b/manifests/rule.pp
@@ -1,5 +1,6 @@
# mark is new in 3.4.4
define shorewall::rule(
+ $ensure = present,
$action,
$source,
$destination,
@@ -13,6 +14,7 @@ define shorewall::rule(
$order
){
shorewall::entry{"rules.d/${order}-${name}":
+ ensure => $ensure,
line => "# ${name}\n${action} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${originaldest} ${ratelimit} ${user} ${mark}",
}
}
diff --git a/manifests/rules/out/ssh/disable.pp b/manifests/rules/out/ssh/disable.pp
new file mode 100644
index 0000000..223bf73
--- /dev/null
+++ b/manifests/rules/out/ssh/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::out::ssh::disable inherits shorewall::rules::out::ssh {
+ Shorewall::Rule['me-net-tcp_ssh']{
+ action => 'DROP',
+ }
+}
diff --git a/manifests/rules/out/ssh/remove.pp b/manifests/rules/out/ssh/remove.pp
new file mode 100644
index 0000000..bc0acf3
--- /dev/null
+++ b/manifests/rules/out/ssh/remove.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::out::ssh::remove inherits shorewall::rules::out::ssh {
+ Shorewall::Rule['me-net-tcp_ssh']{
+ ensure => absent,
+ }
+}