From 9d0f0c3ac04152214faccf89d48d0a134426f4fc Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 24 May 2024 10:45:32 +0100 Subject: [PATCH] modified secuirty group rules --- ansible/vars/protected.yml | 81 ++++++++++++++++++++++++++++++++++++++ ansible/vars/standard.yml | 12 ++---- 2 files changed, 85 insertions(+), 8 deletions(-) diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index e69de29..1c4f407 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -0,0 +1,81 @@ +os_network: external + +security_groups: + - domain_controller + - file_server + - wsus_server + - chocolatey_server + - user_vms + - domain_member + - proxy + +remote_group_rules: +# Domain Controllers + - { direction: "ingress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS UDP"} + - { direction: "ingress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS TCP"} + - { direction: "ingress", protocol: "udp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication UDP"} + - { direction: "ingress", protocol: "tcp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication TCP"} + - { direction: "ingress", protocol: "udp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP UDP"} + - { direction: "ingress", protocol: "tcp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP TCP"} + - { direction: "ingress", protocol: "udp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change UDP"} + - { direction: "ingress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change TCP"} + - { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135, group: "domain_controller", remote_group: "domain_member", comment: "RPC"} + - { direction: "ingress", protocol: "udp", port_min: 137, port_max: 138, group: "domain_controller", remote_group: "domain_member", comment: "NetBIOS"} + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_controller", remote_group: "domain_member", comment: "SMB"} + - { direction: "ingress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_controller", remote_group: "domain_member", comment: "LDAPS"} + - { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"} + - { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"} + - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_member", comment: "FRS RPC"} +# File servers + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted + - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"} +# WSUS servers + - { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"} +# Chocolatey servers + - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "domain_member", comment: "Chocolatey HTTP"} + - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "chocolatey_server", remote_group: "domain_member", comment: "Chocolatey HTTPS"} + +# Client egress + - { direction: "egress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_member", remote_group: "domain_controller", comment: "DNS UDP"} + - { direction: "egress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_member", remote_group: "domain_controller", comment: "DNS TCP"} + - { direction: "egress", protocol: "udp", port_min: 88, port_max: 88, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos authentication UDP"} + - { direction: "egress", protocol: "tcp", port_min: 88, port_max: 88, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos authentication TCP"} + - { direction: "egress", protocol: "udp", port_min: 389, port_max: 389, group: "domain_member", remote_group: "domain_controller", comment: "LDAP UDP"} + - { direction: "egress", protocol: "tcp", port_min: 389, port_max: 389, group: "domain_member", remote_group: "domain_controller", comment: "LDAP TCP"} + - { direction: "egress", protocol: "udp", port_min: 464, port_max: 464, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos password change UDP"} + - { direction: "egress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos password change TCP"} + - { direction: "egress", protocol: "tcp", port_min: 135, port_max: 135, group: "domain_member", remote_group: "domain_controller", comment: "RPC"} + - { direction: "egress", protocol: "udp", port_min: 137, port_max: 138, group: "domain_member", remote_group: "domain_controller", comment: "NetBIOS"} + - { direction: "egress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_member", remote_group: "domain_controller", comment: "SMB"} + - { direction: "egress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_member", remote_group: "domain_controller", comment: "LDAPS"} + - { direction: "egress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_member", remote_group: "domain_controller", comment: "Global catalog"} + - { direction: "egress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_member", remote_group: "domain_controller", comment: "W32Time"} + - { direction: "egress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_member", remote_group: "domain_controller", comment: "FRS RPC"} + - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_group: "chocolatey_server", comment: "Chocolatey HTTP"} + - { direction: "egress", protocol: "tcp", port_min: 443, port_max: 443, group: "domain_member", remote_group: "chocolatey_server", comment: "Chocolatey HTTPS"} + - { direction: "egress", protocol: "tcp", port_min: 3128, port_max: 3128, group: "domain_member", remote_group: "proxy", comment: "HTTP proxy"} + + +remote_ip_rules: +# User VMs + - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"} +# File servers + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"} + +# All Winwdows VMs + - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"} + - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.1.150/32", comment: "CheckMK Agent"} + - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"} + - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} + - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} +# Proxy + - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "proxy", remote_ip: "10.1.0.0/24", comment: "http"} + - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "proxy", remote_ip: "10.1.0.0/24", comment: "https"} + + +# ONLY PROTECTED FOR PROXY SSH and http[s] + #- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.4.71/32", comment: "SSH rundeck 1"} + #- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.172/32", comment: "SSH rundeck 2"} + #- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.242/32", comment: "SSH rundeck 3"} + #- { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "proxy", remote_group: "", comment: "HTTP proxy"} + #- { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "proxy", remote_group: "", comment: "HTTPS proxy"} diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml index 7b0266d..4df5dff 100644 --- a/ansible/vars/standard.yml +++ b/ansible/vars/standard.yml @@ -1,7 +1,3 @@ -#security_group_rules: # maybe separate groups more -# - { description: "example", direction: "ingress", state: "{{ state }}", secgrp: "domain_controller", etc........} -# - { description: "example", direction: "ingress", state: "{{ state }}", secgrp: "domain_controller", etc........} - os_network: external security_groups: @@ -12,6 +8,7 @@ security_groups: - user_vms - domain_member + remote_group_rules: # Domain Controllers - { direction: "ingress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS UDP"} @@ -29,17 +26,16 @@ remote_group_rules: - { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"} - { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"} - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_member", comment: "FRS RPC"} - - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_controller", comment: "FRS RPC"} + #- { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_controller", comment: "FRS RPC"} # redundant because of above rule # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"} # WSUS servers - { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"} # Chocolatey servers - - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "user_vms", comment: "http"} # user_vms or domain_member??? - - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "chocolatey_server", remote_group: "user_vms", comment: "https"} + - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "domain_member", comment: "http"} + - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "chocolatey_server", remote_group: "domain_member", comment: "https"} -# remote_ip_rules: # User VMs