alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor ufw.yml to include retries and delay for firewall rules

Browse Source
This commit is contained in:
Alexandre Pires
2024-09-26 20:34:46 +02:00
parent 26b7eb6ac9
commit 4032d5c1d3
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/cis_hardening/tasks/ufw.yml
+16
View File
@@ -93,6 +93,8 @@
policy: deny policy: deny
log: true log: true
comment: ansible managed comment: ansible managed
retries: 5
delay: 10
tags: tags:
- ufw - ufw
- CIS-UBUNTU2004-3.5.1.7 - CIS-UBUNTU2004-3.5.1.7
@@ -108,6 +110,8 @@
log: true log: true
logging: low logging: low
comment: ansible managed comment: ansible managed
retries: 5
delay: 10
tags: tags:
- ufw - ufw
- CIS-UBUNTU2004-3.5.1.7 - CIS-UBUNTU2004-3.5.1.7
@@ -137,6 +141,8 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ ssh_allowed_networks }}" - "{{ ssh_allowed_networks }}"
retries: 5
delay: 10
tags: tags:
- ufw - ufw
- M1037 - M1037
@@ -151,6 +157,8 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ fw_allowed_ports }}" - "{{ fw_allowed_ports }}"
retries: 5
delay: 10
tags: tags:
- ufw - ufw
- M1037 - M1037
@@ -164,6 +172,8 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ ufw_outgoing_traffic }}" - "{{ ufw_outgoing_traffic }}"
retries: 5
delay: 10
tags: tags:
- ufw - ufw
- CIS-UBUNTU2004-3.5.1.5 - CIS-UBUNTU2004-3.5.1.5
@@ -182,6 +192,8 @@
- ufw - ufw
- CIS-UBUNTU2004-3.5.1.4 - CIS-UBUNTU2004-3.5.1.4
- M1037 - M1037
retries: 5
delay: 10
when: fw_loopback_traffic_deny when: fw_loopback_traffic_deny
- name: Allow loopback traffic in - name: Allow loopback traffic in
@@ -191,6 +203,8 @@
interface: lo interface: lo
direction: in direction: in
comment: ansible managed comment: ansible managed
retries: 5
delay: 10
tags: tags:
- ufw - ufw
- CIS-UBUNTU2004-3.5.1.4 - CIS-UBUNTU2004-3.5.1.4
@@ -203,6 +217,8 @@
interface: lo interface: lo
direction: out direction: out
comment: ansible managed comment: ansible managed
retries: 5
delay: 10
tags: tags:
- ufw - ufw
- CIS-UBUNTU2004-3.5.1.4 - CIS-UBUNTU2004-3.5.1.4
ansible/roles/microk8s/tasks/microk8s/ufw.yml
+10
View File
@@ -7,6 +7,8 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ k8s_net_devices }}" - "{{ k8s_net_devices }}"
retries: 5
delay: 10
- name: Allow out required devices - name: Allow out required devices
become: true become: true
@@ -17,6 +19,8 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ k8s_net_devices }}" - "{{ k8s_net_devices }}"
retries: 5
delay: 10
- name: Allow incoming specific ports - name: Allow incoming specific ports
become: true become: true
@@ -28,6 +32,8 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ k8s_incoming_traffic }}" - "{{ k8s_incoming_traffic }}"
retries: 5
delay: 10
- name: Allow outgoing specified ports - name: Allow outgoing specified ports
become: true become: true
@@ -38,6 +44,8 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ k8s_outgoing_traffic }}" - "{{ k8s_outgoing_traffic }}"
retries: 5
delay: 10
- name: Allow hosts to access the API - name: Allow hosts to access the API
become: true become: true
@@ -49,3 +57,5 @@
comment: ansible managed comment: ansible managed
with_items: with_items:
- "{{ k8s_allowed_hosts }}" - "{{ k8s_allowed_hosts }}"
retries: 5
delay: 10