Re: Iptables standards and configuration management
On Sat, Aug 2, 2008 at 4:03 PM, Mike McGrath <mmcgrath(a)redhat.com> wrote:
On Sat, 2 Aug 2008, Stephen John Smoogen wrote:
> One of the items that I have to deal with at UNM is a long list of
> different firewalls and servers. I have Solaris(9,10), AIX(various),
> MacOSX(various), and SuSE(various), RHEL(2,3,4,5), and Fedora(7,8,9)
> to worry about with lots of different firewall needs for each one. As
> I am trying to standardize the firewalls... I run into that same
> headache everyone runs into at some point or another... How does one
> organize the various different firewalls in both the VCS and the
> upcoming configuration management system... while perfect is the enemy
> of the good.. what is a good way of doing it as I see way to many ways
> of laying it out in file structure.
>
> firewalls/project/OS/system
> project/firewall/OS/system
> OS/firewall/project/system
> OS/system/project/firewall
>
> etc etc etc. with some other // items added. Any ideas?
>
Hmmm, well. My initial thought for the standard was to focus explicitly
on Red Hat family type stuff which could mean the rest of that is not
compliant. Even in the RH family type stuff I'm not quite sure the best
way to manage firewalls. We're doing them with puppet templates right now
but our firewall rules are fairly simple.
Perhaps the firewall standard could explicitly focus on iptables to at
least not be RH specific but trying to write up something for a lot of
different types of firewalls seems a bit out of scope for CSI.
Actually what I was thinking was a bit bigger than firewalls. In a
corporate/university/etc environment there are going to be lots of
different systems to deal with... how do you best manage that
complexity? [Say program set A requires one set of LDAP servers, and
set B requires another set.. and C is some beast in between.] Managing
the complexity of proliferation of files can be the hardest challenge
in taking over an existing setup and bringing it to order.
./rhel3
./rhel3/authorization/
./rhel3/authorization/projectA/
./rhel3/authorization/projectB/
./rhel3/email/
./rhel3/email/list-cluster/
./rhel3/email/groupwise/
./rhel3/email/zimbra/
./rhel3/email/mail-relays/
./rhel3/firewall/
./rhel3/firewall/projectA/
./rhel3/firewall/projectC/
....
./rhel3/logwatch/
./rhel3/monitoring/
./rhel3/openssh/
./rhel3/printing/
./rhel3/resolver/
./rhel3/superusers/
./rhel3/syslog/
./rhel3/tcp_wrapper/
./rhel3/timeservices/
./rhel3/backups/
./rhel3/usersec/
....
--
Stephen J Smoogen. -- BSD/GNU/Linux
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"