So konfigurieren Sie eine Firewall auf Centos mit Vagrant und Chef

8031
justinhj

Ich habe eine Server-Box mit Vagrant und Chef erstellt, und alles läuft einwandfrei. Wenn die Box jedoch von Grund auf installiert wird, gelten die Standardregeln für iptables. Daher muss ich die Firewall deaktivieren, um auf meinen Webserver zugreifen zu können.

(Dies ist eine lokale VM, also kümmere ich mich nicht um die Firewall-Sicherheit).

Beim Starten der VM ssh ssh dazu und leeren Sie die iptables, was gut funktioniert. Aber ich würde am liebsten ein Shell-Skript ausführen, wenn der Rechner dafür erstellt wurde.

Noch besser wäre es mir, wenn Sie die iptables mit einem Rezept konfigurieren würden, aber ich sehe kein unterstütztes Kochbuch.

Vielen Dank

6

1 Antwort auf die Frage

9
Greg Elin

One way to set the firewall rules in CentOS is to replace the /etc/sysconfig/iptables entirely by using a template in the recipe.

Say you want to adjust the routing because you are setting up an Apache web server ("apache2") cookbook. Create the file cookbooks/apache2/templates/default/iptables.erb with following content:

# Firewall configuration created and managed by Chef # Do not edit manually *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT -A INPUT -m tcp -p tcp --dport 443 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT

Be sure and have a line return after the COMMIT.

Then call the template in your recipe, and afterward restart the iptables service.

# # Load firewall rules we know works # template "/etc/sysconfig/iptables" do # path "/etc/sysconfig/iptables" source "iptables.erb" owner "root" group "root" mode 00600 # notifies :restart, resources(:service => "iptables") end  execute "service iptables restart" do user "root" command "service iptables restart" end

When you run vagrant up, you will see the following output (excerpt).

... INFO: Processing template[/etc/sysconfig/iptables] action create (bpif_apache2::default line 40) INFO: template[/etc/sysconfig/iptables] backed up to /var/chef/backup/etc/sysconfig/iptables.chef-20130312055953 INFO: template[/etc/sysconfig/iptables] updated content INFO: template[/etc/sysconfig/iptables] owner changed to 0 INFO: template[/etc/sysconfig/iptables] group changed to 0 INFO: template[/etc/sysconfig/iptables] mode changed to 600 INFO: Processing execute[service iptables restart] action run (bpif_apache2::default line 49) INFO: execute[service iptables restart] ran successfully ...

The following links helped me grok and finally solve this problem.

FWIW, Opscode seems to be to find the firewalls in CentOS a bit of a challenge, too, as per their apache2 cookbook README (Feb 23, 2013):

The easiest but certainly not ideal way to deal with IPtables is to flush all rules. Opscode does provide an iptables cookbook but is migrating from the approach used there to a more robust solution utilizing a general "firewall" LWRP that would have an "iptables" provider. Alternately, you can use ufw, with Opscode's ufw and firewall cookbooks to set up rules. See those cookbooks' READMEs for documentation.

Verwandte Probleme