kris/vagrant-easyredmine
1
0
Fork 0
mirror of https://github.com/krislamo/vagrant-easyredmine synced 2025-01-05 14:10:35 +00:00
Code Issues Releases Wiki Activity

firewalld block icmp timestamp responses

Browse Source
This commit is contained in:
Mark Heiges 2016-04-26 11:20:52 -04:00
parent e68b778711
commit 29e63763cd
3 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
roles/easyredmine/files/timestamp-reply.xml Normal file
View File

@ -0,0 +1,7 @@
<?xml version="1.0" encoding="utf-8"?>
<icmptype>
<short>Timestamp Reply</short>
<description>This message is used to reply to a timestamp message.</description>
<destination ipv4="yes"/>
<destination ipv6="no"/>
</icmptype>

7
roles/easyredmine/files/timestamp-request.xml Normal file
View File

@ -0,0 +1,7 @@
<?xml version="1.0" encoding="utf-8"?>
<icmptype>
<short>Timestamp Request</short>
<description>This message is used for time synchronization.</description>
<destination ipv4="yes"/>
<destination ipv6="no"/>
</icmptype>

20
roles/easyredmine/tasks/firewall.yml
View File

@ -35,6 +35,26 @@
notify: restart firewalld notify: restart firewalld
when: is_production_vm == True when: is_production_vm == True
- name: define new icmp types for timestamp responses
copy: dest='/etc/firewalld/icmptypes/{{ item }}.xml'
src='{{ item }}.xml'
sudo: yes
with_items:
- timestamp-reply
- timestamp-request
- name: load new icmp types for timestamp responses
command: firewall-cmd --reload
sudo: yes
- name: disable icmp timestamp responses
command: firewall-cmd --permanent --zone=public --add-icmp-block={{ item }}
sudo: yes
with_items:
- timestamp-reply
- timestamp-request
notify: restart firewalld
- name: restart firewalld - name: restart firewalld
service: name=firewalld service: name=firewalld
state=restarted state=restarted