node-final.cfg

#version=DEVEL
# System authorization information
auth --enableshadow --passalgo=sha512
# Use network installation
url --url="http://mirror.vcu.edu/pub/gnu_linux/centos/7/os/x86_64/"

repo --name="CentOS" --baseurl="https://mirror.vcu.edu/pub/gnu_linux/centos/7/os/x86_64/" --cost=100
repo --name="updates7" --baseurl="http://mirror.vcu.edu/pub/gnu_linux/centos/7/updates/x86_64/" --cost=100
repo --name="extras" --baseurl="https://mirror.vcu.edu/pub/gnu_linux/centos/7/extras/x86_64/" --cost=100
repo --name="sclo" --baseurl="https://mirror.vcu.edu/pub/gnu_linux/centos/7/sclo/x86_64/sclo/" --cost=100
repo --name="sclrh" --baseurl="https://mirror.vcu.edu/pub/gnu_linux/centos/7/sclo/x86_64/rh" --cost=100
repo --name="cr" --baseurl="https://mirror.vcu.edu/pub/gnu_linux/centos/7/cr/x86_64/" --cost=100
repo --name="epel" --baseurl="https://mirror.vcu.edu/pub/linux/epel/7/x86_64/" --cost=100

#NOTE : Enabling elrepo on virtual machines may have unexpected results
# Enable elrepo on Sun systems
repo --name="elrepo" --baseurl="https://mirror.vcu.edu/pub/linux/elrepo/elrepo/el7/x86_64/" --cost=30
# Use graphical install
graphical
# Run the Setup Agent on first boot
firstboot --enable

# Partition clearing information
ignoredisk --only-use=sda,sdb
zerombr
clearpart --all --initlabel --drives=sda,sdb
# Disk partitioning information
part raid.01 --fstype="mdmember" --size=1024 --ondrive=sda --asprimary
part swap --fstype="swap" --size=4096 --ondisk=sda --fsoptions="pri=1"
part raid.02 --fstype="mdmember" --size=5000 --ondrive=sda --grow


part raid.03 --fstype="mdmember" --size=1024 --ondrive=sdb --asprimary
part swap --fstype="swap" --size=4096 --ondisk=sdb --fsoptions="pri=1"
part raid.04 --fstype="mdmember" --size=5000 --ondrive=sdb --grow

raid /boot --device=md0 --fstype="ext4" --level=RAID1 raid.01 raid.03

raid pv.01 --device=md1 --fstype="lvmpv" --level=RAID1 raid.02 raid.04 
volgroup mirror pv.01

logvol /  --fstype="ext4" --size=25600 --name=root --vgname=mirror

# CCE-26557-9: Ensure /home Located On Separate Partition
logvol /home  --fstype="ext4" --size=40960 --name=home --vgname=mirror --fsoptions="nodev,nosuid"

# CCE-26639-5: Ensure /var Located On Separate Partition
logvol /var   --fstype="ext4"  --size=40960  --name=var  --vgname=mirror --fsoptions="nodev"

# CCE-26215-4: Ensure /var/log Located On Separate Partition
logvol /var/log  --fstype="ext4" --size=10240 --name=log --vgname=mirror --fsoptions="nodev"

# CCE-26436-6: Ensure /var/log/audit Located On Separate Partition
logvol /var/log/audit  --fstype="ext4" --size=1024 --name=audit --vgname=mirror --fsoptions="nodev"

# CCE-26435-8: Ensure /tmp Located On Separate Partition
logvol /tmp   --fstype="ext4" --size=1024   --name=tmp  --vgname=mirror --fsoptions="nodev,nosuid,noexec"



# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'
# System language
lang en_US.UTF-8

# Network information
network  --bootproto=dhcp --device=enp6s4f0 --ipv6=auto --activate
network  --bootproto=dhcp --device=enp6s4f1 --onboot=off --ipv6=auto
network  --hostname=ouroboros.chpc.vcu.edu

# System services
services --enabled="chronyd"
# System timezone
timezone America/New_York --isUtc --ntpservers=gateway
# System bootloader configuration
bootloader --append="rhgb quiet crashkernel=auto" --location=mbr --driveorder="sda,sdb" --boot-drive=sda


# Root password
rootpw --plaintext linuxisfun
# User accounts 
user --name=yuriprym   --gecos="Yuri Glasglow"  --password=linuxisfun --groups="wheel" --uid=1600 --gid=1600
user --name=quandre    --gecos="Happy Wheels"    --password=linuxisfun --groups="wheel"
user --name=glaed      --gecos="J-Dawg Mizzle" --password=linuxisfun --groups="wheel"
user --name=cgchildr   --gecos="Carlisle "     --password=linuxisfun --uid=2000 --gid=2000
user --name=youngse7   --gecos="Samuel Young"  --password=linuxisfun
user --name=millerjm24 --gecos="Justin Miller" --password=linuxisfun
user --name=holtqj     --gecos="Quinn Holt"    --password=linuxisfun
user --name=jenningsdm --gecos="David Jennings" --password=linuxisfun

reboot

%packages
#@^compute-node-environment
@base
@compat-libraries
@core
#@debugging
#@development
@hardware-monitoring
@infiniband
@network-file-system-client
#@performance
#@scientific
@security-tools
chrony
kexec-tools

#Enable network ports 2 and 3
elrepo-release
kmod-forcedeth

#hardware util
memtest86+
smartmontools
bonnie++
stress 
stress-ng
lm_sensors
hddtemp

#dhcp
dhcp

#editors
vim-enhanced

#tftp server
xinetd
tftp-server
syslinux-tftpboot

#apc communication
apcupsd

%end

%addon com_redhat_kdump --enable --reserve-mb='auto'

%end

%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end

#################
## Post-Installation Stuff
#################

%post --logfile /root/install.ks-postinstall.log

cat /proc/cmdline > /root/install.ks-boot_parameters

if grep -i -q "node=[a-zA-Z0-9]" /proc/cmdline
then
THIS_NODE=`cat /proc/cmdline | sed 's/.*node=\([^ ]*\).*/\1/'`
fi

BACKUPDIR=/root/Backups

# Varibles
THIS_CLUSTER=ouroboros

IPADDR=$THIS_NODE
THIS_SUBNET=192.168.200
THIS_NETMASK=255.255.255.0
THIS_NETWORK=$THIS_SUBNET.0
THIS_BROADCAST=$THIS_SUBNET.255
#THIS_GATEWAY=192.168.200.1
THIS_IPADDR=$THIS_SUBNET.$IPADDR
THIS_HOSTNAME=$THIS_CLUSTER$THIS_NODE
DNS1=128.172.1.2
DNS2=128.172.1.1


#########################
## BACKUP CONFIGURATION
#########################

if [ ! -d "${BACKUPDIR}" ]; then mkdir ${BACKUPDIR}; fi

    /bin/cp -LRipd /etc ${BACKUPDIR}/etc-BACKUP

#############################
# NEW NETWORK CONFIGURATION
#############################

#cat > ${BACKUPDIR}/network << EOFNETWORK
#NETWORKING=yes
#HOSTNAME=${THIS_HOSTNAME}
#EOFNETWORK


cat > ${BACKUPDIR}/ifcfg-enp6s4f0 << 'EOFETH0'

DEVICE=enp6s4f0
NAME="enp6s4f0"
IPV6INIT=no
IPV6_AUTOCONF=no
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
BOOTPROTO=none
ONBOOT=yes
IPADDR=128.172.190.234
PREFIX=24
GATEWAY=128.172.190.254
DNS1=128.172.1.2
DNS2=128.172.1.1

EOFETH0

## DEPLOY

#/bin/cp -f ${BACKUPDIR}/ifcfg-enp6s4f0 /etc/sysconfig/network-scripts/ifcfg-enp6s4f0
#/bin/chown root:root /etc/sysconfig/network-scripts/ifcfg-enp6s4f0
#/bin/chmod       644 /etc/sysconfig/network-scripts/ifcfg-enp6s4f0

cat > ${BACKUPDIR}/ifcfg-enp6s4f1 << 'EOFETH0'

DEVICE=enp6s4f1
NAME="enp6s4f1"
IPV6INIT=no
IPV6_AUTOCONF=no
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
DEFROUTE=no
IPV4_FAILURE_FATAL=no
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
BOOTPROTO=none
ONBOOT=yes
IPADDR=192.168.200.1
PREFIX=24
DNS1=128.172.1.2
DNS2=128.172.1.1

EOFETH0

## DEPLOY

#/bin/cp -f ${BACKUPDIR}/ifcfg-enp6s4f1 /etc/sysconfig/network-scripts/ifcfg-enp6s4f1
#/bin/chown root:root /etc/sysconfig/network-scripts/ifcfg-enp6s4f1
#/bin/chmod       644 /etc/sysconfig/network-scripts/ifcfg-enp6s4f1


##############################
# TURN OFF UNNEEDED SERVICES
##############################

# CCE-RHEL7-CCE-TBD Disable the CUPS Service
systemctl disable cups.service
systemctl stop cups.service
systemctl disable cups.path
systemctl disable cups.socket

###########################
# TURN ON NEEDED SERVICES
###########################

systemctl enable rsyslog.service


##############
## Post Boot
##############

cat > ${BACKUPDIR}/postboot-reminders.txt << 'EOFREM'

Add post install reminders here

EOFREM

cat > ${BACKUPDIR}/postboot-dhcpd.txt << 'EOFDHCP'

# more /etc/dhcp/dhcpd.conf
#
# DHCP Server Configuration file.
#   see /usr/share/doc/dhcp*/dhcpd.conf.example
#   see dhcpd.conf(5) man page
#
# From /usr/share/doc/dhcp-4.2.5/dhcpd.conf.example
#
# Sample configuration file for ISC dhcpd
#

# From
#https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/chap-installation-server-setup.html

option space pxelinux;
option pxelinux.magic code 208 = string;
option pxelinux.configfile code 209 = text;
option pxelinux.pathprefix code 210 = text;
option pxelinux.reboottime code 211 = unsigned integer 32;
option architecture-type code 93 = unsigned integer 16;

# option definitions common to all supported networks...
#option domain-name "example.org";
#option domain-name-servers 128.172.1.2, 128.172.1.1;

#default-lease-time 600;
#max-lease-time 7200;

# Use this to enble / disable dynamic dns updates globally.
#ddns-update-style none;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
#authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# No service will be given on this subnet, but declaring it helps the
# DHCP server to understand the network topology.

#subnet 10.152.187.0 netmask 255.255.255.0 {
#}


subnet 172.29.0.0 netmask 255.255.240.0 {
}

subnet 192.168.66.128 netmask 255.255.255.192 {
}

# This declaration allows BOOTP clients to get dynamic addresses,
# which we don't really recommend.

#subnet 10.254.239.32 netmask 255.255.255.224 {
#  range dynamic-bootp 10.254.239.40 10.254.239.60;
#  option broadcast-address 10.254.239.31;
#  option routers rtr-239-32-1.example.org;
#}


# From https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/chap-installation-server-setup.html

subnet 10.0.200.0 netmask 255.255.255.0 {
  range 10.0.200.2 10.0.200.127;
  option routers 10.0.200.1;
  option domain-name-servers 128.172.1.1, 128.172.1.2;
  option ntp-servers ntp.vcu.edu;
#  default-lease-time 600;
#  max-lease-time 7200;
  default-lease-time 86400; # 24 hours
  max-lease-time 604800; # 1 week
  authoritative;

  class "pxeclients" {
      match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
      next-server 10.0.200.1; # The ip address of the tftp server

  if option architecture-type = 00:07 {
          filename "uefi/bootx64.efi";
        } else {
            filename "pxelinux/pxelinux.0";
          }
  }

  host switch {
    hardware ethernet 00:04:ea:38:2d:00;
    fixed-address 10.0.200.254;
  }

}


subnet 10.0.100.0 netmask 255.255.255.0 {
  range 10.0.100.2 10.0.100.127;
  option routers 10.0.100.1;
  option domain-name-servers 128.172.1.1, 128.172.1.2;
#  option ntp-servers ntp.vcu.edu;
  option ntp-servers 10.0.200.1;
  default-lease-time 600;
  #  max-lease-time 7200;
  default-lease-time 86400; # 24 hours
  max-lease-time 604800; # 1 week
  authoritative;

}


EOFDHCP

cat > ${BACKUPDIR}/tftpd.txt << 'EOFTFTP'

# default: off
# description: The tftp server serves files using the trivial file transfer \
#    protocol.  The tftp protocol is often used to boot diskless \
#    workstations, download configuration files to network-aware printers, \
#    and to start the installation process for some operating systems.
service tftp
{
    socket_type        = dgram
    protocol        = udp
    wait            = yes
    user            = root
    server            = /usr/sbin/in.tftpd
    server_args        = -vv -s /var/lib/tftpboot
#    disable            = yes
    disable            = no    
    per_source        = 11
    cps            = 100 2
    flags            = IPv4
}

# more /etc/hosts.allow
----

#
# hosts.allow    This file contains access rules which are used to
#        allow or deny connections to network services that
#        either use the tcp_wrappers library or that have been
#        started through a tcp_wrappers-enabled xinetd.
#
#        See 'man 5 hosts_options' and 'man 5 hosts_access'
#        for information on rule syntax.
#        See 'man tcpd' for information on tcp_wrappers
#

# Allow allow services to localhost
ALL: 127.0.0.1 LOCAL localhost

# Allow ssh from all ip addresses
sshd: ALL

# Allow ssh from only 192.168.0.0/16
#sshd: 192.168.

# # Allow ssh from all ip addresses
sshd: ALL

#ALL: 10.0.200.

in.tftpd: 10.0.200.

----


# more /var/lib/tftpboot/linux-install/pxelinux.cfg/default 

----
default vesamenu.c32
prompt 0
timeout 600

##display boot.msg

label linux
  menu label ^Install system
  menu default
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img ip=dhcp inst.repo=http://mirror.vcu.edu/pub/gnu_linux/centos/7/os/x86_64/ 
label vesa
  menu label Install system with ^basic video driver
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img ip=dhcp inst.xdriver=vesa nomodeset inst.repo=http://mirror.vcu.edu/pub/gnu_linux/centos/7/os/x86_64/
label rescue
  menu label ^Rescue installed system
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img rescue

label local
  menu label Boot from ^local drive
  localboot 0xffff

LABEL Centos7
        MENU LABEL Centos 7
        KERNEL vesamenu.c32
        APPEND centos/centos7.cfg


----


# more /var/lib/tftpboot/linux-install/centos/centos7.cfg 

----
MENU TITLE Centos 7

LABEL Main 
        MENU LABEL Return to ^Main Menu
        KERNEL vesamenu.c32
        APPEND pxelinux.cfg/default



default vesamenu.c32
prompt 1
timeout 600

display boot.msg

label linux
  menu label ^Install system
  menu default
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img ip=dhcp syslog=10.0.200.1 inst.repo=https://mirror.vcu.edu/pub/gnu_linux/centos/7/os/x86_64/

label vesa
  menu label Install system with ^basic video driver
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img ip=dhcp syslog=10.0.200.1 inst.xdriver=vesa nomodeset inst.repo=https://mirror.vcu.edu/pub/gnu_linux/centos/7/os/x86_64/

label rescue
  menu label ^Rescue installed system
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img rescue

label vnc
# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-vnc-installations-anaconda-modes.html
  menu label Install system using ^VNC
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img ip=dhcp syslog=10.0.200.1 inst.vnc inst.vncpassword=abc123 inst.repo=https://mirror.vcu.edu/pub/gnu_linux/centos/7/os/x86_64/

label kickstart
  menu label ^Kickstart
  menu default
  kernel centos/7/x86_64/vmlinuz
  append initrd=centos/7/x86_64/initrd.img ip=dhcp syslog=10.0.200.1 loglevel=debug inst.ks=https://mirror.vcu.edu/~cgchildr/ks/x2200-c7-ks.cfg


label local
  menu label Boot from ^local drive
  localboot 0xffff



----
Uefi pxe booting using grub

# more /var/lib/tftpboot/uefi/grub.cfg
##set default="1"

function load_video {
  insmod efi_gop
  insmod efi_uga
  insmod video_bochs
  insmod video_cirrus
  insmod all_video
}

load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod ext2

set timeout=600
### END /etc/grub.d/00_header ###

search --no-floppy --set=root -l 'CentOS 7 x86_64'

### BEGIN /etc/grub.d/10_linux ###
menuentry 'Install CentOS Linux 7' --class fedora --class gnu-linux --class gnu --class os {
    linuxefi  uefi/centos/7/x86_64/vmlinuz inst.stage2=hd:LABEL=CentOS\x207\x20x86_64 quiet
    initrdefi uefi/centos/7/x86_64/initrd.img 
}
menuentry 'Install CentOS Linux 7 A' --class fedora --class gnu-linux --class gnu --class os {
  linuxefi  uefi/centos/7/x86_64/vmlinuz inst.keymap=us inst.lang=en_US inst.repo=https://mirror.vcu.edu/pub/linux/centos/7/os/x86_64/ ip=
dhcp
  initrdefi uefi/centos/7/x86_64/initrd.img
}
menuentry 'Install CentOS Linux 7 VNC' --class fedora --class gnu-linux --class gnu --class os {
  linuxefi  uefi/centos/7/x86_64/vmlinuz inst.keymap=us inst.lang=en_US ip=dhcp inst.repo=https://mirror.vcu.edu/pub/gnu_linux/centos/7/os
/x86_64/ inst.vnc inst.vncpassword=abc123
  initrdefi uefi/centos/7/x86_64/initrd.img
}
menuentry 'Install CentOS Linux 7 Kickstart' --class fedora --class gnu-linux --class gnu --class os {
  linuxefi  uefi/centos/7/x86_64/vmlinuz ip=dhcp inst.ks=https://mirror.vcu.edu/ks/fenn64-ks.cfg 
  initrdefi uefi/centos/7/x86_64/initrd.img
}
menuentry 'Install Fenn Node manually enter node number' --class fedora --class gnu-linux --class gnu --class os {
  linuxefi  uefi/centos/7/x86_64/vmlinuz ip=dhcp syslog=10.0.200.1 loglevel=debug inst.ks=https://mirror.vcu.edu/ks/fenn-64c7-ks
.cfg node=19
  initrdefi uefi/centos/7/x86_64/initrd.img
}



menuentry 'Test this media & install CentOS Linux 7' --class fedora --class gnu-linux --class gnu --class os {
    linuxefi  uefi/centos/7/x86_64/vmlinuz inst.stage2=hd:LABEL=CentOS\x207\x20x86_64 rd.live.check quiet
    initrdefi uefi/centos/7/x86_64/initrd.img
}
submenu 'Troubleshooting -->' {
    menuentry 'Install CentOS Linux 7 in basic graphics mode' --class fedora --class gnu-linux --class gnu --class os {
        linuxefi  uefi/centos/7/x86_64/vmlinuz inst.stage2=hd:LABEL=CentOS\x207\x20x86_64 xdriver=vesa nomodeset quiet
        initrdefi uefi/centos/7/x86_64/initrd.img
    }
    menuentry 'Rescue a CentOS Linux system' --class fedora --class gnu-linux --class gnu --class os {
        linuxefi  uefi/centos/7/x86_64/vmlinuz  inst.stage2=hd:LABEL=CentOS\x207\x20x86_64 rescue quiet
        initrdefi uefi/centos/7/x86_64/initrd.img 
    }
  menuentry 'Rescue a CentOS Linux system A' --class fedora --class gnu-linux --class gnu --class os {
    linuxefi  uefi/centos/7/x86_64/vmlinuz inst.keymap=us inst.lang=en_US inst.repo=https://mirror.vcu.edu/pub/linux/centos/7/os/x86_64/ i
p=dhcp rescue
    initrdefi uefi/centos/7/x86_64/initrd.img
  }

}

EOFTFTP

cat > ${BACKUPDIR}/iptables.txt << 'EOFIPT'

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o enp6s4f0.2717 -j MASQUERADE
COMMIT
*filter
### CCE-26444-0 Set the default policy to DROP
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
##:INPUT ACCEPT [0:0]
##:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

## persistent blacklist
## packets dropped here are not logged

## Once you start logging blocked packets, the iptables log will become
## noisy. The following are examples of traffic that is common on a 
## network and can be ignored.

## common network broadcasts which can be ignored
##-A INPUT -p udp -m udp -s <non-authoritative ntp>   --dport 123 -j DROP

## windows file sharing
##-A INPUT -p udp -m udp -s <windoze machine>  --dport 137:138 -j DROP
#-A INPUT -p udp -m udp --dport 137:138 -j DROP

## ipv4 dhcp server
-A INPUT -p udp -m udp -d 255.255.255.255 --dport 67:68 -i enp6s4f0.3691 -j DROP

## # Microsoft Office OS X anti-piracy broadcasts
##-A INPUT -p udp -m udp -d 255.255.255.255 --dport 2222 -j DROP
##-A INPUT -p udp -m udp -d 255.255.255.255 --dport 2223 -j DROP

## dropbox lansync
##-A INPUT -p udp -m udp --sport 17500  --dport 17500 -j DROP

## spotify broadcasts
##-A INPUT -p udp -m udp --sport 57621 --dport 57621 -j DROP

## cups broadcasts
##-A INPUT -p udp -m udp -d 128.172.190.255  --dport 631 -j DROP

## smtp?
##-A INPUT -p udp -m udp -s 192.168.132.5 --dport 161 -j DROP

## just blacklist these noisy addresses
##-A INPUT -s 128.172.190.33  -j DROP


-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


#### Example ipset to block ingoing and outgoing traffic
##-A INPUT   -m set --match-set IPSET_LABEL src -j DROP
##-A FORWARD -m set --match-set IPSET_LABEL src -j DROP
##-A OUTPUT  -m set --match-set IPSET_LABLE dst -m limit --limit 5/m --limit-burst 20 -j LOG --log-prefix " IPv4 OUTPUT " --log-level debug
##-A OUTPUT  -m set --match-set IPSET_LABLE dst -j DROP


#### Block certain icmp traffic CVE-1999-0524
-A INPUT  -m icmp -p icmp --icmp-type timestamp-request -j DROP
-A INPUT  -m icmp -p icmp --icmp-type address-mask-request -j DROP
-A OUTPUT -m icmp -p icmp --icmp-type timestamp-reply -j DROP

-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type echo-request -m limit --limit 2/second -j ACCEPT


#### loopback - never block
-A INPUT -i lo -j ACCEPT

# accept everything from the internet interfaces
# until all proper firewall rules can be written
-A INPUT -i enp6s4f1 -j ACCEPT
-A INPUT -i ib0 -j ACCEPT

## Allow forwarding from enp6s4f1 (the internal interfacing)
## to enp6s4f0.2717 (the external interface)
## also must verify that /proc/sys/net/ipv4/ip_forward is 1

-A FORWARD -i enp6s4f0.2717 -o enp6s4f1      -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i enp6s4f1      -o enp6s4f0.2717 -j ACCEPT
-A FORWARD -i enp6s4f0.2717 -o ib0           -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i ib0           -o enp6s4f0.2717 -j ACCEPT

#### ssh
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

#### accept tftpd requests from internal network
-A INPUT -m state --state NEW -m udp -p udp --dport 69 -i enp6s4f1 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 69 -i ib0      -j ACCEPT

#### accept dhcpd requests from internal network
-A INPUT -m state --state NEW -m udp -p udp --dport 67 -i enp6s4f1 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 67 -i ib0      -j ACCEPT

#### accept rsyslog traffic from internal network
-A INPUT -m state --state NEW -m udp -p udp --dport 514 -i enp6s4f1 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 514 -i enp6s4f1 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 514 -i ib0      -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 514 -i ib0      -j ACCEPT


#### log all dropped packets
-A INPUT   -m limit --limit 5/m --limit-burst 20  -j LOG --log-prefix " IPv4 INPUT "   --log-level debug
-A FORWARD -m limit --limit 5/m --limit-burst 20  -j LOG --log-prefix " IPv4 FORWARD " --log-level debug

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT


EOFIPT

cat > ${BACKUPDIR}/forwarding.conf << 'EOFFOR'

### CCE-80157-1 Disable Kernel Parameter for IP Forwarding
### CIS 4.1.1   Disable IP Forwarding
#net.ipv4.ip_forward = 0

# Enable Forwarding
net.ipv4.ip_forward = 1

# To manually enable forwarding use:
# sysctl -w net.ipv4.ip_forward=1

# see current status
# cat /proc/sys/net/ipv4/ip_forward


EOFFOR


############################
# Send email when complete
############################

/bin/mail -s Kickstart_Installation_Complete holtqj@vcu.edu,millerjm24@vcu.edu,youngse7@vcu.edu,raynorj@vcu.edu < /dev/null 

%end