mirror of
https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git
synced 2026-10-26 21:37:21 +00:00
52 lines
4.5 KiB
YAML
52 lines
4.5 KiB
YAML
os_network: external
|
|
|
|
security_groups:
|
|
- domain_controller
|
|
- file_server
|
|
- wsus_server
|
|
- chocolatey_server
|
|
- user_vms
|
|
- domain_member
|
|
|
|
|
|
remote_group_rules:
|
|
# Domain Controllers
|
|
- { direction: "ingress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS UDP"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS TCP"}
|
|
- { direction: "ingress", protocol: "udp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication UDP"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication TCP"}
|
|
- { direction: "ingress", protocol: "udp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP UDP"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP TCP"}
|
|
- { direction: "ingress", protocol: "udp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change UDP"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change TCP"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135, group: "domain_controller", remote_group: "domain_member", comment: "RPC"}
|
|
- { direction: "ingress", protocol: "udp", port_min: 137, port_max: 138, group: "domain_controller", remote_group: "domain_member", comment: "NetBIOS"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_controller", remote_group: "domain_member", comment: "SMB"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_controller", remote_group: "domain_member", comment: "LDAPS"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"}
|
|
- { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_member", comment: "FRS RPC"}
|
|
#- { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_controller", comment: "FRS RPC"} # redundant because of above rule
|
|
# File servers
|
|
- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted
|
|
- { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"}
|
|
# WSUS servers
|
|
- { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"}
|
|
# Chocolatey servers
|
|
- { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "domain_member", comment: "http"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "chocolatey_server", remote_group: "domain_member", comment: "https"}
|
|
|
|
|
|
remote_ip_rules:
|
|
# User VMs
|
|
- { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"}
|
|
# File servers
|
|
- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"}
|
|
|
|
# All Winwdows VMs
|
|
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.172/32", comment: "WinRM rundeck 2"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}
|
|
- { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"}
|
|
# create groups with no rules add default egress here???
|