Skip to content

Commit 07636b4

Browse files
tanmayd1996tanmayd1996
authored
Merge pull request #3 from tmuehle/master
Blog post added on "Controlling PF rules with SMF and IPS"
2 parents e2c6c25 + 400dc0d commit 07636b4

File tree

10 files changed

+477
-0
lines changed

10 files changed

+477
-0
lines changed

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/README.md

+370
Large diffs are not rendered by default.

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/firewall-stencil-profile.xml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<service_bundle type='profile' name='network/firewall'>
2+
<service name='network/firewall' type='service' version='1'>
3+
<property_group name="firewall_stencil" type="configfile">
4+
<propval name="path" type="astring" value="/etc/firewall/pf.conf"/>
5+
<propval name="stencil" type="astring" value="firewall.stencil"/>
6+
<propval name="mode" type="astring" value="0644"/>
7+
</property_group>
8+
</service>
9+
</service_bundle>

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/firewall-webui-profile.xml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<service_bundle type='profile' name='network/firewall'>
2+
<service name='network/firewall' type='service' version='1'>
3+
<property_group name='include' type='framework'>
4+
<propval name='webui' type='astring' value='/etc/firewall/pf.webui'/>
5+
</property_group>
6+
</service>
7+
</service_bundle>

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/firewall.stencil

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#
2+
# Copyright (c) 2015, 2017, Oracle and/or its affiliates. All rights reserved.
3+
#
4+
#
5+
# /etc/firewall/pf.conf
6+
#
7+
#
8+
# This is a sample PF firewall configuration file. Solaris currently ships with
9+
# PF firewall alternate to current IPF. PF is meant to replace IPF in future
10+
# Solaris releases. We encourage customers with customized IPF configuration to
11+
# try to migrate their firewall rules to PF. See our release notes/documentation
12+
# for hints how to migrate your custom configuration.
13+
#
14+
# There is no action for you if you are using default IPF configuration (a.k.a.
15+
# host based firewall). See svc.ipfd(1M) to find out how to check if you are
16+
# affected.
17+
#
18+
19+
#
20+
# PF does IP reassembly by default. We also use 'no-df' option on Solaris
21+
# to ensure IP reassembly working with broken stacks which can send packets
22+
# with invalid flag combination 'MF|DF'.
23+
#
24+
set reassemble yes no-df
25+
26+
#
27+
# We don't want PF to filter on loopback traffic by default.
28+
#
29+
# Filtering on loopback can interfere with zone installation and other
30+
# operations due to Solaris loopback optimizations. See the pf.conf(5)
31+
# manpage for guidance on how to enable it for your application.
32+
set skip on lo0
33+
34+
## block everything unless told otherwise
35+
## and send TCP-RST/ICMP unreachable
36+
## for every packet which gets blocked
37+
block return log
38+
39+
## accept incoming icmp pkts e.g. ping
40+
pass in proto icmp from any to any
41+
42+
## accept incoming SSH connections
43+
pass in proto tcp to any port 22 flags any keep state (sloppy)
44+
45+
## accept connections for rsyslog
46+
pass in proto tcp from any to any port = 6514
47+
48+
## includes
49+
; walk each instance and extract all properties from the config PG
50+
;$%/(svc:/$%s:(.*)/:properties)/{
51+
$%/(svc:/$%s:(.*)/:properties)/{$%/$%1/include/(.*)/{include "$%{$%1/include/$%3}"
52+
}}
53+
54+
## allow all connections initiated from this system,
55+
## including DHCP requests
56+
pass out

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/pf-firewall-webui.p5m.4.res

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
set name=pkg.fmri value=pkg://vpbank/vpbank/security/[email protected]
2+
set name=pkg.summary value="PF FIREWALL conf /etc/firewall/pf.webui (build with 11.4 SRU 7)"
3+
set name=pkg.description value="This package contains the webui configuration for the pf firewall and the corresponding service."
4+
set name=variant.arch value=i386 value=sparc
5+
file etc/firewall/pf.webui path=etc/firewall/pf.webui owner=root group=sys mode=0644 refresh_fmri=svc:/network/firewall:default
6+
file etc/svc/profile/site/firewall-webui-profile.xml path=etc/svc/profile/site/firewall-webui-profile.xml owner=root group=sys mode=0444 restart_fmri=svc:/system/manifest-import:default

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/pf.ips

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## accept connections for Solaris IPS repository
2+
pass in proto tcp from any to any port = 8113
3+
pass in proto tcp from any to any port = 8114

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/pf.puppet

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
## accept connections for oracle puppet
2+
pass in proto tcp from any to any port = 8140

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/pf.rad

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
K muehle@wacken % cat PF_FIREWALL_RAD/PROTO.PF_FIREWALL_RAD/etc/firewall/pf.rad /data/build 0
2+
## accept connections for oracle solaris rad:remote
3+
pass in proto tcp from any to any port = 12302
4+
pass in proto tcp from any to any port = 8102

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/pf.webui

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
PF_FIREWALL_WEBUI/PROTO.PF_FIREWALL_WEBUI/etc/firewall/pf.webui /data/build 0
2+
## accept connections for oracle solaris webui dashboard
3+
pass in proto tcp from any to any port = 6787

‎Blog_Supplements/Controlling_PF_Rules_with_SMF_and_IPS/example_files/pf_firewall_webui.mog

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
set name=pkg.fmri value=pkg://odev/security/[email protected]
2+
set name=pkg.summary value="PF FIREWALL conf /etc/firewall/pf.webui (build with st_085)"
3+
set name=pkg.description value="This package contains the webui configuration for the pf firewall and the corresponding service."
4+
set name=variant.arch value=sparc value=i386
5+
<transform dir path=etc$ -> drop>
6+
<transform dir path=etc/svc$ -> drop>
7+
<transform dir path=etc/svc/profile$ -> drop>
8+
<transform dir path=etc/svc/profile/site$ -> drop>
9+
<transform file path=etc/svc/profile/site/firewall-webui-profile.xml$ -> set owner root>
10+
<transform file path=etc/svc/profile/site/firewall-webui-profile.xml$ -> set group sys>
11+
<transform file path=etc/svc/profile/site/firewall-webui-profile.xml$ -> set mode 0444>
12+
<transform file path=etc/svc/profile/site/firewall-webui-profile.xml$ -> default restart_fmri svc:/system/manifest-import:default>
13+
<transform dir path=etc/firewall$ -> drop>
14+
<transform file path=etc/firewall/pf.webui$ -> set owner root>
15+
<transform file path=etc/firewall/pf.webui$ -> set group sys>
16+
<transform file path=etc/firewall/pf.webui$ -> set mode 0644>
17+
<transform file path=etc/firewall/pf.webui$ -> default refresh_fmri svc:/network/firewall:default>

0 commit comments

Comments
 (0)