Optional ufw module ERROR: Could not find profile matching 'xxxxx'

Question

I am working on setting up UFW rules through Ansible. I can install it, run it and deny everything. Then I try to allow connections with http, https and ssh. All attempts to add allowed for these elements are performed with errors that look like this:

failed: [lempy1] (item={u'service': u'http'}) => {"failed": true, "item": {"service": "http"}, "msg": "ERROR: Could not find a profile matching 'http'\n"} failed: [lempy1] (item={u'service': u'https'}) => {"failed": true, "item": {"service": "https"}, "msg": "ERROR: Could not find a profile matching 'https'\n"} failed: [lempy1] (item={u'service': u'ssh'}) => {"failed": true, "item": {"service": "ssh"}, "msg": "ERROR: Could not find a profile matching 'ssh'\n"} 

The whole role looks like this:

Tasks /main.yml

  --- - name: Install ufw apt: name=ufw state=present tags: - security - name: Allow webservery things ufw: rule: allow name: '{{item.service}}' with_items: - service: http - service: https - service: ssh tags: - security - name: Start ufw ufw: state=enabled policy=deny tags: - security 

Any idea why I can’t allow these services? I can correctly add services when ssh'ing to the server and run sudo ufw allow http etc.

Answer 1

As mentioned in the ufw module docs , the name (or app) parameter uses the applications registered in /etc/ufw/applications.d that have the INI format and see something like this:

 [CUPS] title=Common UNIX Printing System server description=CUPS is a printing system with support for IPP, samba, lpd, and other protocols. ports=631 

You can usually use ufw allow application-profile so that an application defined either in /etc/ufw/applications.d or /etc/services opens iptables for things that are not necessarily defined in /etc/ufw/applications.d .

Unfortunately, Ansible ufw module instead builds the ufw command in this format:

 /usr/sbin/ufw allow from any to any app 'application-profile' 

which uses only the /etc/ufw/applications.d list and will not read /etc/services .

In your case, you can simply specify the ports as they are well known, potentially using a named variable to further explain your Ansible code:

 - name: Allow webservery things ufw: rule: allow port: '{{ item }}' with_items: - '{{ http_port }}' - '{{ https_port }}' - '{{ ssh_port }}' tags: - security 

And then define the variables somewhere (e.g. your default values):

 http_port: 80 https_port: 443 ssh_port: 22 

As an aside, you may notice that I have simplified your list of dictionaries with one key into a simpler direct list, which simplifies your task a bit.

Alternatively, you can easily create application templates using the Ansible template.