From a20e4a26b5c7b02448552095339007cf9602ac2d Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 18 Sep 2024 08:38:12 +0100 Subject: [PATCH] add ports for DFSR --- ansible/vars/protected.yml | 6 +++++- ansible/vars/standard.yml | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index f26e7b6..ebb11cb 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -28,7 +28,8 @@ remote_group_rules: - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_member", comment: "FRS RPC"} # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted - - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"} + - { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"} + - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC client ports"} # WSUS servers - { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"} # Chocolatey servers @@ -36,6 +37,9 @@ remote_group_rules: - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "chocolatey_server", remote_group: "domain_member", comment: "Chocolatey HTTPS"} - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "proxy", comment: "HTTP from proxy"} +# File servers egress + - { direction: "egress", protocol: "tcp", port_min: 135, port_max: 135, group: "file_server", remote_group: "file_server", comment: "RPC"} + # Client egress - { direction: "egress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_member", remote_group: "domain_controller", comment: "DNS UDP"} - { direction: "egress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_member", remote_group: "domain_controller", comment: "DNS TCP"} diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml index 6e12bd4..2cf4a68 100644 --- a/ansible/vars/standard.yml +++ b/ansible/vars/standard.yml @@ -26,10 +26,10 @@ remote_group_rules: - { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"} - { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"} - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_member", comment: "FRS RPC"} - #- { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_controller", comment: "FRS RPC"} # redundant because of above rule # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted - - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"} + - { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"} + - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC client ports"} # WSUS servers - { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"} # Chocolatey servers