From 3154748728d8a8b2dc9a40a87855e4e4d054119f Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 12 Apr 2024 13:12:46 +0000 Subject: [PATCH] fix http and https rule for choco server and added RPC for domain members --- ansible/vars/standard.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml index 08bc96a..eb86f2c 100644 --- a/ansible/vars/standard.yml +++ b/ansible/vars/standard.yml @@ -28,14 +28,15 @@ remote_group_rules: - { direction: "ingress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_controller", remote_group: "domain_member", comment: "LDAPS"} - { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"} - { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"} - - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_controller", comment: "FRS RPC"} # needed for dc02 promotion + - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_member", comment: "FRS RPC"} + - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_controller", comment: "FRS RPC"} # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted # WSUS servers - { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"} # Chocolatey servers - - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_controller", remote_group: "user_vms", comment: "http"} - - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "domain_controller", remote_group: "user_vms", comment: "https"} + - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "user_vms", comment: "http"} # user_vms or domain_member??? + - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "chocolatey_server", remote_group: "user_vms", comment: "https"} #