Compare commits
9 Commits
v0.0.3o-jl
...
v0.0.3t-em
Author | SHA1 | Date | |
---|---|---|---|
9019c0dbe7 | |||
9fd18796a6 | |||
6e33ccce33 | |||
f38fca4561 | |||
01c2b76936 | |||
a6a35324ba | |||
70950f9e4e | |||
a7f366a124 | |||
143c3878a3 |
19
roles/fw-ferm-1/README.md
Normal file
19
roles/fw-ferm-1/README.md
Normal file
@ -0,0 +1,19 @@
|
||||
[Ferm]:http://ferm.foo-projects.org/
|
||||
|
||||
Modifier l'execution d'iptables [plus d'info ici]:https://wiki.debian.org/iptables
|
||||
```bash
|
||||
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
||||
```
|
||||
|
||||
Pour tester utiliser [Nmap]:https://nmap.org/man/fr/man-briefoptions.html
|
||||
```bash
|
||||
sudo nmap -p51820 192.168.0.51
|
||||
```(r-vp1)
|
||||
```bash
|
||||
sudo nmap -p51820 192.168.0.52
|
||||
```(r-vp2)
|
||||
|
||||
Sortie :
|
||||
`PORT STATE SERVICE
|
||||
51820/tcp filtered unknown`
|
||||
Faire des ping!
|
19
roles/fw-ferm-2/README.md
Normal file
19
roles/fw-ferm-2/README.md
Normal file
@ -0,0 +1,19 @@
|
||||
[Ferm]:http://ferm.foo-projects.org/
|
||||
|
||||
Modifier l'execution d'iptables [plus d'info ici]:https://wiki.debian.org/iptables
|
||||
```bash
|
||||
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
||||
```
|
||||
|
||||
Pour tester utiliser [Nmap]:https://nmap.org/man/fr/man-briefoptions.html
|
||||
```bash
|
||||
sudo nmap -p51820 192.168.0.51
|
||||
```(r-vp1)
|
||||
```bash
|
||||
sudo nmap -p51820 192.168.0.52
|
||||
```(r-vp2)
|
||||
|
||||
Sortie :
|
||||
`PORT STATE SERVICE
|
||||
51820/tcp filtered unknown`
|
||||
Faire des ping!
|
62
roles/fw-ferm-2/ferm.conf
Normal file
62
roles/fw-ferm-2/ferm.conf
Normal file
@ -0,0 +1,62 @@
|
||||
# -*- shell-script -*-
|
||||
#
|
||||
# Ferm script r-vp2
|
||||
|
||||
@def $DEV_PRIVATE = enp0s9;
|
||||
@def $DEV_WORLD = enp0s8;
|
||||
|
||||
@def $NET_PRIVATE = 172.16.0.0/24;
|
||||
|
||||
table filter {
|
||||
chain (INPUT OUTPUT){
|
||||
# allow VPN
|
||||
proto udp dport 51820 ACCEPT;
|
||||
}
|
||||
chain INPUT {
|
||||
policy DROP;
|
||||
|
||||
# connection tracking
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
|
||||
# allow local connections
|
||||
interface lo ACCEPT;
|
||||
|
||||
# respond to ping
|
||||
proto icmp icmp-type echo-request ACCEPT;
|
||||
|
||||
# allow SSH connections from the private network and from some
|
||||
# well-known internet hosts
|
||||
saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
|
||||
|
||||
# we provide DNS and SMTP services for the internal net
|
||||
interface $DEV_PRIVATE saddr $NET_PRIVATE {
|
||||
proto (udp tcp) dport domain ACCEPT;
|
||||
proto udp dport bootps ACCEPT;
|
||||
}
|
||||
|
||||
# interface réseau
|
||||
interface $DEV_WORLD {
|
||||
|
||||
}
|
||||
|
||||
# the rest is dropped by the above policy
|
||||
}#FIN INPUT
|
||||
|
||||
# outgoing connections are not limited
|
||||
chain OUTPUT policy ACCEPT;
|
||||
|
||||
chain FORWARD {
|
||||
policy ACCEPT;
|
||||
|
||||
# connection tracking
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
|
||||
# connections from the internal net to the internet or to other
|
||||
# internal nets are allowed
|
||||
interface $DEV_PRIVATE ACCEPT;
|
||||
|
||||
# the rest is dropped by the above policy
|
||||
}
|
||||
}
|
68
s-lb-bd.yml
68
s-lb-bd.yml
@ -1,24 +1,50 @@
|
||||
---
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
vars:
|
||||
maria_dbhost: "192.168.102.254"
|
||||
maria_dbname: "wordpress"
|
||||
maria_dbuser: "wp"
|
||||
maria_dbpasswd: "wp"
|
||||
- hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
|
||||
- name: modules python pour
|
||||
apt:
|
||||
name: python3-pymysql
|
||||
state: present
|
||||
|
||||
roles:
|
||||
- base
|
||||
- goss
|
||||
- post
|
||||
#- s-lb-bd-ab
|
||||
- mariadb-ab
|
||||
# - role: db-user
|
||||
# cli_ip: "192.168.102.1"
|
||||
# - role: db-user
|
||||
# cli_ip: "192.168.102.2"
|
||||
# - role: db-user
|
||||
# cli_ip: "192.168.102.3"
|
||||
- snmp-agent
|
||||
# - post
|
||||
- name: install mariadb-server
|
||||
apt:
|
||||
name: mariadb-server
|
||||
state: present
|
||||
|
||||
- name: Cree Bd wordpress
|
||||
mysql_db:
|
||||
db: wordpressdb
|
||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
state: present
|
||||
|
||||
- name: Ouvre port 3306 mariadb-server
|
||||
replace:
|
||||
path: /etc/mysql/mariadb.conf.d/50-server.cnf
|
||||
regexp: '^bind-address.*'
|
||||
replace: '#bind-adress = 127.0.0.1'
|
||||
backup: yes
|
||||
notify: restart mariadb
|
||||
|
||||
- name: Create MySQL user for wordpress
|
||||
mysql_user:
|
||||
name: wordpressuser
|
||||
password: wordpresspasswd
|
||||
priv: "wordpressdb.*:ALL"
|
||||
host: '%'
|
||||
state: present
|
||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
|
||||
handlers:
|
||||
- name: restart mariadb
|
||||
ansible.builtin.service:
|
||||
name: mariadb
|
||||
state: restarted
|
||||
|
||||
roles:
|
||||
- base
|
||||
- goss
|
||||
- post
|
||||
- mariadb-ab
|
||||
- snmp-agent
|
||||
|
Reference in New Issue
Block a user