Skip to content

Ansible Playbook for setting firewall, security settings, syslog and firewall for Nutanix Clusters

Notifications You must be signed in to change notification settings

nnorakk/Nutanix-Security-Baseline

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

19 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Nutanix Security Baseline

A role to set and/or reset security settings on nutanix cvms for operation in a high governance area

Required Variables

  • ansible_user: nutanix # An account with permissions to provision on the cluster
  • ansible_password: secret # The password to your account, Note, you should not store this in the clear, use Ansible vault

ansible.cfg Changes

  • transfer_method = scp # set transfer_method=scp in the ansible config file as the nutanix nodes have sftp turned off.

tags

There are 5 tags in the playbook so you can run all or some of the settings.

  • cvm - Run CVM tasks
  • ahv - Run ahv related tasks for the hypervisor
  • syslog - syslog settings
  • firewall - set and apply firewall settings on cvms
  • DODbanner - set DODBanner on cvms

For Example it you run

ansible-playbook ntnx_sec.yml -t cvm,DODbanner,firewall 

This will set the firewall and secsettings on a nutanix cluster that is running ESXi, if you have an ahv cluster you do not need any tags.

Invetory Located in the hosts folder

This is where you will list the individual cvms for each node. I would suggest making the your cluster name the group name, for Example

[palo.nutanix.cluster]
palo-ntnx-cvm-a
palo-ntnx-cvm-b
palo-ntnx-cvm-c
palo-ntnx-cvm-d

group_vars

Located in the group_vars folder

Group vars will tell which firewall template to use if you have multiple cluster to manage. The group var must match group name for it to pick up the right firewall template file. So using the example of above for palo.nutanix.cluster you should have group var file named palo.nutanix.cluster.yml which containes the below --- site_firewall_rules: palo.nutanix.cluster_salt.conf.j2

templates

Located under roles/nutanix_baseline/templates

example._salt.conf.h2 # This is where your firewall rules replace example with your site name form the hosts file (inventory) dodbanner.conf.j2 # The is the template for the banner that will be copied to each node in each cluster

Security Settings

This is what the settings will be after the playbook is run, if the setting is set it will skip it

ncli cluster get-cvm-security-config

Enable Aide               : true
Enable Core               : false
Enable High Strength P... : true
Enable Banner             : true
Enable SNMPv3 Only        : true
Schedule                  : Daily

Tasks

main.yml - main task List - Tasks can be comment out if not needed

  • checksecsettings.yml # checks to see what security settings are set
  • dodbanner.yml # imports custom DODbanner to all cvms
  • cvmsecsettings.yml # sets cvm security settings
  • ahvsecsettings.yml # sets the hypervisor security settings on the cvm (AHV only)
  • firewall.yml # copy firewall rules to all cvms
  • syslog.yml # Set the syslog
  • apply.yml apply firewall rules on all cvms

Example commands

This will run the playbook on a cluster that does not have AHV hypervisor

ansible-playbook ntnx_sec.yml -l nutanix_cluster_name -t cvm,security,syslog,firewall  

This will run the playbook on an AHV cluster

 ansible-playbook ntnx_sec.yml -l nutanix_cluster_name 

This will run the playbook on all nutanix clusters defined in the inventory

 ansible-playbook ntnx_sec.yml

About

Ansible Playbook for setting firewall, security settings, syslog and firewall for Nutanix Clusters

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published