Compare commits

..

9 Commits

4 changed files with 147 additions and 21 deletions

19
roles/fw-ferm-1/README.md Normal file
View File

@ -0,0 +1,19 @@
[Ferm]:http://ferm.foo-projects.org/
Modifier l'execution d'iptables [plus d'info ici]:https://wiki.debian.org/iptables
```bash
update-alternatives --set iptables /usr/sbin/iptables-legacy
```
Pour tester utiliser [Nmap]:https://nmap.org/man/fr/man-briefoptions.html
```bash
sudo nmap -p51820 192.168.0.51
```(r-vp1)
```bash
sudo nmap -p51820 192.168.0.52
```(r-vp2)
Sortie :
`PORT STATE SERVICE
51820/tcp filtered unknown`
Faire des ping!

19
roles/fw-ferm-2/README.md Normal file
View File

@ -0,0 +1,19 @@
[Ferm]:http://ferm.foo-projects.org/
Modifier l'execution d'iptables [plus d'info ici]:https://wiki.debian.org/iptables
```bash
update-alternatives --set iptables /usr/sbin/iptables-legacy
```
Pour tester utiliser [Nmap]:https://nmap.org/man/fr/man-briefoptions.html
```bash
sudo nmap -p51820 192.168.0.51
```(r-vp1)
```bash
sudo nmap -p51820 192.168.0.52
```(r-vp2)
Sortie :
`PORT STATE SERVICE
51820/tcp filtered unknown`
Faire des ping!

62
roles/fw-ferm-2/ferm.conf Normal file
View File

@ -0,0 +1,62 @@
# -*- shell-script -*-
#
# Ferm script r-vp2
@def $DEV_PRIVATE = enp0s9;
@def $DEV_WORLD = enp0s8;
@def $NET_PRIVATE = 172.16.0.0/24;
table filter {
chain (INPUT OUTPUT){
# allow VPN
proto udp dport 51820 ACCEPT;
}
chain INPUT {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# allow local connections
interface lo ACCEPT;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# allow SSH connections from the private network and from some
# well-known internet hosts
saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
# we provide DNS and SMTP services for the internal net
interface $DEV_PRIVATE saddr $NET_PRIVATE {
proto (udp tcp) dport domain ACCEPT;
proto udp dport bootps ACCEPT;
}
# interface réseau
interface $DEV_WORLD {
}
# the rest is dropped by the above policy
}#FIN INPUT
# outgoing connections are not limited
chain OUTPUT policy ACCEPT;
chain FORWARD {
policy ACCEPT;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# connections from the internal net to the internet or to other
# internal nets are allowed
interface $DEV_PRIVATE ACCEPT;
# the rest is dropped by the above policy
}
}

View File

@ -1,24 +1,50 @@
---
- hosts: localhost
connection: local
vars:
maria_dbhost: "192.168.102.254"
maria_dbname: "wordpress"
maria_dbuser: "wp"
maria_dbpasswd: "wp"
- hosts: all
become: true
tasks:
- name: modules python pour
apt:
name: python3-pymysql
state: present
roles:
- base
- goss
- post
#- s-lb-bd-ab
- mariadb-ab
# - role: db-user
# cli_ip: "192.168.102.1"
# - role: db-user
# cli_ip: "192.168.102.2"
# - role: db-user
# cli_ip: "192.168.102.3"
- snmp-agent
# - post
- name: install mariadb-server
apt:
name: mariadb-server
state: present
- name: Cree Bd wordpress
mysql_db:
db: wordpressdb
login_unix_socket: /var/run/mysqld/mysqld.sock
state: present
- name: Ouvre port 3306 mariadb-server
replace:
path: /etc/mysql/mariadb.conf.d/50-server.cnf
regexp: '^bind-address.*'
replace: '#bind-adress = 127.0.0.1'
backup: yes
notify: restart mariadb
- name: Create MySQL user for wordpress
mysql_user:
name: wordpressuser
password: wordpresspasswd
priv: "wordpressdb.*:ALL"
host: '%'
state: present
login_unix_socket: /var/run/mysqld/mysqld.sock
handlers:
- name: restart mariadb
ansible.builtin.service:
name: mariadb
state: restarted
roles:
- base
- goss
- post
- mariadb-ab
- snmp-agent