From 65b00c88400a774d0cbc40459c0d1e80bc31cbb4 Mon Sep 17 00:00:00 2001 From: Marius Melzer Date: Sat, 20 Apr 2024 17:08:39 +0200 Subject: [PATCH 1/3] Add ufw role - Enable ufw and by default deny incoming traffic - in other roles: if ufw (role) is enabled, then allow necessary ports --- roles/lighttpd/tasks/main.json | 26 +++++++++++++++++++++ roles/murmur/tasks/main.json | 17 ++++++++++++++ roles/nginx/tasks/main.json | 26 +++++++++++++++++++++ roles/proftpd/tasks/main.json | 26 +++++++++++++++++++++ roles/synapse/tasks/main.json | 17 ++++++++++++++ roles/ufw/tasks/main.json | 41 ++++++++++++++++++++++++++++++++++ 6 files changed, 153 insertions(+) create mode 100644 roles/ufw/tasks/main.json diff --git a/roles/lighttpd/tasks/main.json b/roles/lighttpd/tasks/main.json index 1b6af91..8e85d43 100644 --- a/roles/lighttpd/tasks/main.json +++ b/roles/lighttpd/tasks/main.json @@ -27,6 +27,32 @@ "dest": "/etc/lighttpd/conf-enabled/10-ssl-custom.conf" } }, + { + "name": "Check wether enabling UFW would be considered a changed", + "check_mode": true, + "community.general.ufw": { + "state": "enabled", + "register": "ufw_enable_check" + } + }, + { + "name": "Allow port 80 in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "80", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" + }, + { + "name": "Allow port 443 in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "443", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" + }, { "name": "restart service", "become": true, diff --git a/roles/murmur/tasks/main.json b/roles/murmur/tasks/main.json index 7341ac8..b8303b2 100644 --- a/roles/murmur/tasks/main.json +++ b/roles/murmur/tasks/main.json @@ -25,6 +25,23 @@ "cmd": "murmurd -ini /etc/mumble-server.ini -supw {{var_murmur_admin_password}}" } }, + { + "name": "Check wether enabling UFW would be considered a changed", + "check_mode": true, + "community.general.ufw": { + "state": "enabled", + "register": "ufw_enable_check" + } + }, + { + "name": "Allow port in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "{{ var_murmur_port }}", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" + }, { "name": "service", "become": true, diff --git a/roles/nginx/tasks/main.json b/roles/nginx/tasks/main.json index c8e2b40..39a68de 100644 --- a/roles/nginx/tasks/main.json +++ b/roles/nginx/tasks/main.json @@ -9,6 +9,32 @@ ] } }, + { + "name": "Check wether enabling UFW would be considered a changed", + "check_mode": true, + "community.general.ufw": { + "state": "enabled", + "register": "ufw_enable_check" + } + }, + { + "name": "Allow port 80 in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "80", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" + }, + { + "name": "Allow port 443 in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "443", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" + }, { "name": "restart service", "become": true, diff --git a/roles/proftpd/tasks/main.json b/roles/proftpd/tasks/main.json index d277bc0..53374a6 100644 --- a/roles/proftpd/tasks/main.json +++ b/roles/proftpd/tasks/main.json @@ -8,5 +8,31 @@ "proftpd-core" ] } + }, + { + "name": "Check wether enabling UFW would be considered a changed", + "check_mode": true, + "community.general.ufw": { + "state": "enabled", + "register": "ufw_enable_check" + } + }, + { + "name": "Allow FTP port 20 in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "20", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" + }, + { + "name": "Allow FTP port 21 in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "21", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" } ] diff --git a/roles/synapse/tasks/main.json b/roles/synapse/tasks/main.json index fd44ce1..ef5c79c 100644 --- a/roles/synapse/tasks/main.json +++ b/roles/synapse/tasks/main.json @@ -58,6 +58,23 @@ "dest": "/etc/matrix-synapse/homeserver.yaml" } }, + { + "name": "Check wether enabling UFW would be considered a changed", + "check_mode": true, + "community.general.ufw": { + "state": "enabled", + "register": "ufw_enable_check" + } + }, + { + "name": "Allow matrix federation port in ufw", + "community.general.ufw": { + "rule": "allow", + "port": "8448", + "proto": "tcp" + }, + "when": "not ufw_enable_check.changed" + }, { "name": "restart service", "become": true, diff --git a/roles/ufw/tasks/main.json b/roles/ufw/tasks/main.json new file mode 100644 index 0000000..b3ed847 --- /dev/null +++ b/roles/ufw/tasks/main.json @@ -0,0 +1,41 @@ +[ + { + "name": "install ufw", + "become": true, + "ansible.builtin.apt": { + "update_cache": true, + "pkg": [ + "ufw" + ] + } + }, + { + "name": "ufw deny incoming", + "ufw": { + "direction": "incoming", + "proto": "any", + "policy": "deny" + } + }, + { + "name": "ufw allow outgoing", + "ufw": { + "direction": "outgoing", + "proto": "any", + "policy": "allow" + } + }, + { + "name": "ufw allow and rate-limit ssh", + "ufw": { + "rule": "limit", + "name": "ssh" + } + }, + { + "name": "enable ufw service", + "ufw": { + "state": "enabled" + } + } +] From 2ac8c9c4c3a75b5e20f7fae4416885814b07a5fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20Fra=C3=9F?= Date: Sat, 1 Jun 2024 13:49:11 +0200 Subject: [PATCH 2/3] [fix] role:ufw:add missing become:true directives [mod] role:ufw:use fully qualified names for ansible tasks --- roles/ufw/tasks/main.json | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/roles/ufw/tasks/main.json b/roles/ufw/tasks/main.json index b3ed847..003e4b6 100644 --- a/roles/ufw/tasks/main.json +++ b/roles/ufw/tasks/main.json @@ -11,7 +11,8 @@ }, { "name": "ufw deny incoming", - "ufw": { + "become": true, + "community.general.ufw": { "direction": "incoming", "proto": "any", "policy": "deny" @@ -19,7 +20,8 @@ }, { "name": "ufw allow outgoing", - "ufw": { + "become": true, + "community.general.ufw": { "direction": "outgoing", "proto": "any", "policy": "allow" @@ -27,14 +29,16 @@ }, { "name": "ufw allow and rate-limit ssh", - "ufw": { + "become": true, + "community.general.ufw": { "rule": "limit", "name": "ssh" } }, { "name": "enable ufw service", - "ufw": { + "become": true, + "community.general.ufw": { "state": "enabled" } } From c7c9e6895cd6df181707e023434b485967ed375b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20Fra=C3=9F?= Date: Sat, 1 Jun 2024 17:56:28 +0200 Subject: [PATCH 3/3] [fix] roles with ufw incocation --- roles/lighttpd/tasks/main.json | 23 +++++++++++++---------- roles/murmur/tasks/main.json | 18 ++++++++++-------- roles/nginx/tasks/main.json | 23 +++++++++++++---------- roles/proftpd/tasks/main.json | 23 +++++++++++++---------- roles/synapse/tasks/main.json | 16 +++++++++------- 5 files changed, 58 insertions(+), 45 deletions(-) diff --git a/roles/lighttpd/tasks/main.json b/roles/lighttpd/tasks/main.json index 8e85d43..d29fcdf 100644 --- a/roles/lighttpd/tasks/main.json +++ b/roles/lighttpd/tasks/main.json @@ -28,30 +28,33 @@ } }, { - "name": "Check wether enabling UFW would be considered a changed", + "name": "ufw | check", "check_mode": true, + "become": true, "community.general.ufw": { - "state": "enabled", - "register": "ufw_enable_check" - } + "state": "enabled" + }, + "register": "ufw_enable_check" }, { - "name": "Allow port 80 in ufw", + "name": "ufw | allow port 80", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", "port": "80", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } }, { - "name": "Allow port 443 in ufw", + "name": "ufw | allow port 443", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", "port": "443", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } }, { "name": "restart service", diff --git a/roles/murmur/tasks/main.json b/roles/murmur/tasks/main.json index b8303b2..1b9ed12 100644 --- a/roles/murmur/tasks/main.json +++ b/roles/murmur/tasks/main.json @@ -26,21 +26,23 @@ } }, { - "name": "Check wether enabling UFW would be considered a changed", + "name": "ufw | check", "check_mode": true, + "become": true, "community.general.ufw": { - "state": "enabled", - "register": "ufw_enable_check" - } + "state": "enabled" + }, + "register": "ufw_enable_check" }, { - "name": "Allow port in ufw", + "name": "ufw | allow port", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", - "port": "{{ var_murmur_port }}", + "port": "{{var_murmur_port | string}}", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } }, { "name": "service", diff --git a/roles/nginx/tasks/main.json b/roles/nginx/tasks/main.json index 39a68de..2fe467c 100644 --- a/roles/nginx/tasks/main.json +++ b/roles/nginx/tasks/main.json @@ -10,30 +10,33 @@ } }, { - "name": "Check wether enabling UFW would be considered a changed", + "name": "ufw | check", + "become": true, "check_mode": true, "community.general.ufw": { - "state": "enabled", - "register": "ufw_enable_check" - } + "state": "enabled" + }, + "register": "ufw_enable_check" }, { - "name": "Allow port 80 in ufw", + "name": "ufw | allow port 80", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", "port": "80", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } }, { - "name": "Allow port 443 in ufw", + "name": "ufw | allow port 443", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", "port": "443", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } }, { "name": "restart service", diff --git a/roles/proftpd/tasks/main.json b/roles/proftpd/tasks/main.json index 53374a6..e5bf9a0 100644 --- a/roles/proftpd/tasks/main.json +++ b/roles/proftpd/tasks/main.json @@ -10,29 +10,32 @@ } }, { - "name": "Check wether enabling UFW would be considered a changed", + "name": "ufw | check", "check_mode": true, + "become": true, "community.general.ufw": { - "state": "enabled", - "register": "ufw_enable_check" - } + "state": "enabled" + }, + "register": "ufw_enable_check" }, { - "name": "Allow FTP port 20 in ufw", + "name": "ufw | allow port 20", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", "port": "20", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } }, { - "name": "Allow FTP port 21 in ufw", + "name": "ufw | allow port 21", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", "port": "21", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } } ] diff --git a/roles/synapse/tasks/main.json b/roles/synapse/tasks/main.json index ef5c79c..63e0e78 100644 --- a/roles/synapse/tasks/main.json +++ b/roles/synapse/tasks/main.json @@ -59,21 +59,23 @@ } }, { - "name": "Check wether enabling UFW would be considered a changed", + "name": "ufw | check", + "become": true, "check_mode": true, "community.general.ufw": { - "state": "enabled", - "register": "ufw_enable_check" - } + "state": "enabled" + }, + "register": "ufw_enable_check" }, { - "name": "Allow matrix federation port in ufw", + "name": "ufw | allow port", + "when": "not ufw_enable_check.changed", + "become": true, "community.general.ufw": { "rule": "allow", "port": "8448", "proto": "tcp" - }, - "when": "not ufw_enable_check.changed" + } }, { "name": "restart service",