adam/windows-ansible
1
0 Fork 0
mirror of https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git synced 2026-10-26 10:57:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

variables for standard zone - WIP

Browse Source
This commit is contained in:
abrown38 committed 2024-04-05 10:20:15 +00:00
1 parent 73e910dede
commit 8284928dfc
1 file changed
+58
Download Patch File Download Diff File Expand all files Collapse all files
ansible/vars/standard.yml
+58
View File
@@ -0,0 +1,58 @@
#security_group_rules: # maybe separate groups more
# - { description: "example", direction: "ingress", state: "{{ state }}", secgrp: "domain_controller", etc........}
# - { description: "example", direction: "ingress", state: "{{ state }}", secgrp: "domain_controller", etc........}
os_network: external
security_groups:
- domain_controller
- file_server
- wsus_server
- chocolatey_server
- user_vms
- domain_member
remote_group_rules:
# Domain Controllers
- { direction: "ingress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS UDP"}
- { direction: "ingress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS TCP"}
- { direction: "ingress", protocol: "udp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication UDP"}
- { direction: "ingress", protocol: "tcp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication TCP"}
- { direction: "ingress", protocol: "udp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP UDP"}
- { direction: "ingress", protocol: "tcp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP TCP"}
- { direction: "ingress", protocol: "udp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change UDP"}
- { direction: "ingress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change TCP"}
- { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135, group: "domain_controller", remote_group: "domain_member", comment: "RPC"}
- { direction: "ingress", protocol: "udp", port_min: 137, port_max: 138, group: "domain_controller", remote_group: "domain_member", comment: "NetBIOS"}
- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_controller", remote_group: "domain_member", comment: "SMB"}
- { direction: "ingress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_controller", remote_group: "domain_member", comment: "LDAPS"}
- { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"}
- { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"}
# File servers
- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted
# WSUS servers
- { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"}
# Chocolatey servers
- { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_controller", remote_group: "user_vms", comment: "http"}
- { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "domain_controller", remote_group: "user_vms", comment: "https"}
#
remote_ip_rules:
# User VMs
- { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"}
# File servers
#- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "<transfer ip>", comment: "SMB"}
# All Winwdows VMs
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5985, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"}
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5985, group: "domain_member", remote_ip: "10.24.3.172/32", comment: "WinRM rundeck 2"}
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5985, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}
# ONLY PROTECTED FOR PROXY SSH and http[s]
#- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.4.71/32", comment: "SSH rundeck 1"}
#- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.172/32", comment: "SSH rundeck 2"}
#- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.242/32", comment: "SSH rundeck 3"}
#- { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "proxy", remote_group: "<proxy client>", comment: "HTTP proxy"}
#- { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "proxy", remote_group: "<proxy client>", comment: "HTTPS proxy"}