Puppet Class: tcpwrappers

Defined in:
manifests/init.pp

Overview

Set up tcpwrappers

Parameters:

  • default_deny (Boolean) (defaults to: true)

    Add a default ALL: ALL to /etc/hosts.deny

  • allow_all_local (Boolean) (defaults to: true)

    Allow connections to all services from the local system

    • This includes all representations of the local system that are available via facter and shortcut notation, such as LOCAL.

Author:



14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
# File 'manifests/init.pp', line 14

class tcpwrappers (
  Boolean $default_deny        = true,
  Boolean $allow_all_local     = true
){
  package { 'tcp_wrappers': ensure => 'latest' }

  concat { '/etc/hosts.allow':
    owner          => 'root',
    group          => 'root',
    mode           => '0444',
    ensure_newline => true,
    warn           => true,
    require        => Package['tcp_wrappers']
  }

  if $default_deny {
    file { '/etc/hosts.deny':
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      content => "ALL: ALL\n",
      require => Package['tcp_wrappers']
    }
  }

  if $allow_all_local {
    $_local_allow = [
      'LOCAL',
      $facts['fqdn'],
      'localhost.localdomain',
      join(ipaddresses(),',')
    ]

    tcpwrappers::allow { 'ALL':
      pattern => join(flatten($_local_allow),','),
      order   => 0
    }
  }
}