modif README.md

goss/list-goss

@@ -0,0 +1,12 @@
+cd goss/
+goss -g r-vp1.yaml v
+goss  -g r-vp1.yaml aa wireguard
+goss add interface enp0s3
+goss add interface enp0s8
+goss add interface enp0s9
+goss add interface wg0
+goss aa wireguard
+goss add package wireguard-tools
+goss add service wg-quick@wg0
+goss add command "ping -c4  10.0.0.2"
+goss add file "/etc/wireguard/wg0.conf"

r-vp1.yml

@@ -15,6 +15,7 @@
 #   - firewall-vpn-r
    - wireguard-r
 #   - x509-r
+   - fw-ferm
    - ssh-cli
    - syslog-cli
    - post

r-vp2.yml

@@ -18,6 +18,7 @@
 #   - firewall-vpn-l
    - wireguard-l
 #   - x509-l
+   - fw-ferm
    - ssh-cli
    - syslog-cli
    - post

roles/fw-ferm/README.md

@@ -0,0 +1,23 @@
+[Ferm]:http://ferm.foo-projects.org/ 
+
+Modifier l'execution d'iptables [plus d'info ici]:https://wiki.debian.org/iptables
+```shell
+update-alternatives --set iptables /usr/sbin/iptables-legacy
+```
+
+Pour tester utiliser [Nmap]:https://nmap.org/man/fr/man-briefoptions.html
+### r-vp1
+```shell
+sudo nmap -p51820  192.168.0.51
+```
+### r-vp2
+```shell
+sudo nmap -p51820  192.168.0.52
+```
+### Sortie :
+```
+`PORT      STATE    SERVICE
+51820/tcp filtered unknown`
+```
+
+Faire des ping!

roles/fw-ferm/files/ferm.conf.r-vp1

@@ -0,0 +1,63 @@
+# -*- shell-script -*-
+#
+# Ferm script r-vp1
+
+@def $DEV_PRIVATE = enp0s8;
+@def $DEV_WORLD = enp0s9;
+
+@def $NET_PRIVATE = 172.16.0.0/24;
+
+table filter {
+    chain (INPUT OUTPUT){
+        # allow VPN
+	proto udp dport 51820 ACCEPT;
+}
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;  
+       
+
+        # allow SSH connections from the private network and from some
+        # well-known internet hosts
+        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+
+        # we provide DNS and SMTP services for the internal net
+        interface $DEV_PRIVATE saddr $NET_PRIVATE {
+            proto (udp tcp) dport domain ACCEPT;
+            proto udp dport bootps ACCEPT;            
+        }
+
+        # interface réseau 
+        interface $DEV_WORLD {
+            
+        }
+
+        # the rest is dropped by the above policy
+    }#FIN INPUT
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # connections from the internal net to the internet or to other
+        # internal nets are allowed
+        interface $DEV_PRIVATE ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+}

roles/fw-ferm/files/ferm.conf.r-vp2

@@ -0,0 +1,62 @@
+# -*- shell-script -*-
+#
+# Ferm script r-vp2
+
+@def $DEV_PRIVATE = enp0s9;
+@def $DEV_WORLD = enp0s8;
+
+@def $NET_PRIVATE = 172.16.0.0/24;
+
+table filter {
+    chain (INPUT OUTPUT){
+        # allow VPN
+	proto udp dport 51820 ACCEPT;
+}
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+
+        # allow SSH connections from the private network and from some
+        # well-known internet hosts
+        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+
+        # we provide DNS and SMTP services for the internal net
+        interface $DEV_PRIVATE saddr $NET_PRIVATE {
+            proto (udp tcp) dport domain ACCEPT;
+            proto udp dport bootps ACCEPT;
+        }
+
+        # interface réseau
+        interface $DEV_WORLD {
+
+        }
+
+        # the rest is dropped by the above policy
+    }#FIN INPUT
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # connections from the internal net to the internet or to other
+        # internal nets are allowed
+        interface $DEV_PRIVATE ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+}

roles/fw-ferm/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+- name: installation de ferm
+  apt:
+    name: ferm
+    state: present
+
+- name: copie du ferm.conf
+  copy:
+    src: ferm.conf.{{ ansible_hostname }}
+    dest: /etc/ferm/ferm.conf
+
+- name: redemarage service ferm
+  ansible.builtin.service:
+    name: ferm.service
+    state: restarted

roles/wireguard-l/tasks/main.yml

@@ -4,16 +4,16 @@
     name: wireguard
     state: present
 
+- name: installation de ferm
+  apt:
+    name: ferm
+    state: present
+
 - name: installation de wireguard-tools
   apt:
     name: wireguard-tools
     state: present
 
-#- name: installation de sshpass
-#  apt:
-#    name: sshpass
-#    state: present
-
 #- name: copie du fichier de configuration depuis r-vp1
 #  command: "sshpass -p 'root' scp -r root@192.168.99.112:/root/confwg/wg0-b.conf /etc/wireguard/"
 

roles/wireguard-r/tasks/main.yml

@@ -4,6 +4,11 @@
     name: wireguard
     state: present
 
+- name: installation de ferm
+  apt:
+    name: ferm
+    state: present
+
 - name: installation de wireguard-tools
   apt:
     name: wireguard-tools
@@ -27,12 +32,10 @@
 - name: copie du fichier de configuration
   copy:
     src: /root/confwg/wg0-a.conf
-    dest: /etc/wireguard
+    dest: /etc/wireguard/wg0.conf
 
-- name: renommage fichier de configuration
+- name: Restart service httpd, in all cases
-  command: "mv /etc/wireguard/wg0-a.conf /etc/wireguard/wg0.conf"
+  ansible.builtin.service:
-
+    name: wg-quick@wg0
-- name: demarrage du service wireguard
+    enabled: yes
-  tags: aaaa
+    state: restarted
-  command: "systemctl enable wg-quick@wg0"
-  command: "systemctl restart wg-quick@wg0"

s-lb-bd.yml

@@ -1,24 +1,49 @@
 ---
- - hosts: localhost
+- hosts: all
-   connection: local
+  become: true
-   vars:
+  tasks:
-        maria_dbhost: "192.168.102.254"
-        maria_dbname: "wordpress"
-        maria_dbuser: "wp"
-        maria_dbpasswd: "wp"
 
+  - name: modules python pour
+    apt:
+      name: python3-pymysql
+      state: present
+
+  - name: install mariadb-server
+    apt:
+      name: mariadb-server
+      state: present
+
+  - name: Cree Bd wordpress
+    mysql_db:
+      db: wordpressdb
+      login_unix_socket: /var/run/mysqld/mysqld.sock
+      state: present
+
+  - name: Ouvre port 3306 mariadb-server
+    replace:
+      path: /etc/mysql/mariadb.conf.d/50-server.cnf
+      regexp: '^bind-address.*'
+      replace: '#bind-adress = 127.0.0.1'
+      backup: yes
+    notify: restart mariadb
+
+  - name: Create MySQL user for wordpress
+    mysql_user:
+      name: wordpressuser
+      password: wordpresspasswd
+      priv: "wordpressdb.*:ALL"
+      host: '%'
+      state: present
+      login_unix_socket: /var/run/mysqld/mysqld.sock
+
+  handlers:
+    - name: restart mariadb
+      ansible.builtin.service:
+        name: mariadb
+        state: restarted
 
   roles:
     - base
     - goss
     - post
-     #- s-lb-bd-ab
-     - mariadb-ab
-#     - role: db-user
-#       cli_ip: "192.168.102.1"
-#     - role: db-user
-#       cli_ip: "192.168.102.2"
-#     - role: db-user
-#       cli_ip: "192.168.102.3"     
     - snmp-agent
-#     - post