diff --git a/manifests/system.pp b/manifests/system.pp index fa8bce621904e8b24c3546959e5ab7f76acb59ff..cf02efba580c28e29546afb82881bb8072aab7c3 100644 --- a/manifests/system.pp +++ b/manifests/system.pp @@ -41,6 +41,27 @@ class analysator::system::nat { } } + # CVE-2024-6387 ("regreSSHion") + # https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt + firewall { '000 block ssh outside lysator (v4)': + chain => 'INPUT', + dport => '22', + source => '! 130.236.254.0/24', + proto => 'tcp', + action => 'reject', + } + + # CVE-2024-6387 ("regreSSHion") + # https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt + firewall { '000 block ssh outside lysator (v6)': + chain => 'INPUT', + dport => '22', + source => '! 2001:6b0:17:f0a0::/64', + proto => 'tcp', + action => 'reject', + provider => 'ip6tables', + } + firewall { '200 forward internal': chain => 'FORWARD', iniface => $analysator::system::internal_iface,