security.yml 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186
  1. - name: 'Install auto upgrades package'
  2. apt:
  3. pkg: 'unattended-upgrades'
  4. state: 'present'
  5. when: with_auto_upgrade
  6. tags:
  7. - 'security'
  8. - name: 'Reconfigure unattended-upgrades package'
  9. debconf:
  10. name: 'unattended-upgrades'
  11. question: 'unattended-upgrades/enable_auto_updates'
  12. value: 'true'
  13. vtype: 'boolean'
  14. notify:
  15. - 'Reconfigure unattended-upgrades'
  16. when: with_auto_upgrade
  17. tags:
  18. - 'security'
  19. - name: 'Update unattended-upgrades configuration'
  20. template:
  21. src: '{{ item }}'
  22. dest: '/etc/apt/apt.conf.d/90unattended-upgrades-local'
  23. owner: 'root'
  24. group: 'root'
  25. mode: '0644'
  26. with_first_found:
  27. - 'apt/auto-upgrades.{{ ansible_lsb.codename }}.j2'
  28. - 'apt/auto-upgrades.j2'
  29. when: with_auto_upgrade
  30. tags:
  31. - 'security'
  32. - name: 'Install logcheck packages'
  33. apt:
  34. pkg: '{{ item }}'
  35. state: 'present'
  36. with_items:
  37. - 'logcheck'
  38. - 'logcheck-database'
  39. when: with_logcheck
  40. tags:
  41. - 'security'
  42. - name: 'Install local configuration files for logcheck'
  43. copy:
  44. src: 'logcheck/{{ item }}_local'
  45. dest: '/etc/logcheck/ignore.d.server/{{ item }}_local'
  46. owner: 'root'
  47. group: 'logcheck'
  48. mode: '0644'
  49. with_items:
  50. - 'amavisd-new'
  51. - 'ansible'
  52. - 'apache2'
  53. - 'bind'
  54. - 'dhclient'
  55. - 'dnsmasq'
  56. - 'dovecot'
  57. - 'dropbear'
  58. - 'ferm'
  59. - 'gammu'
  60. - 'git-daemon'
  61. - 'gogs'
  62. - 'influxd'
  63. - 'ipmi'
  64. - 'irqbalance'
  65. - 'kernel'
  66. - 'libpam-modules'
  67. - 'mon'
  68. - 'noip2'
  69. - 'ntp'
  70. - 'openvpn'
  71. - 'opendkim'
  72. - 'php'
  73. - 'postfix'
  74. - 'pure-ftpd'
  75. - 'pve-cluster'
  76. - 'redir'
  77. - 'rpc-mountd'
  78. - 'rrdcached'
  79. - 'rsyslog'
  80. - 'smartd'
  81. - 'spamd'
  82. - 'sshd'
  83. - 'svn'
  84. - 'sympa'
  85. - 'systemd'
  86. - 'zabbix-agentd'
  87. when: with_logcheck
  88. tags:
  89. - 'security'
  90. - 'logcheck'
  91. - name: 'Update logcheck cron job'
  92. template:
  93. src: 'cron/logcheck.j2'
  94. dest: '/etc/cron.d/logcheck'
  95. owner: 'root'
  96. group: 'root'
  97. mode: '0644'
  98. when: with_logcheck
  99. tags:
  100. - 'security'
  101. - 'logcheck'
  102. - name: 'Install rkhunter related packages'
  103. apt:
  104. pkg: '{{ item }}'
  105. state: 'present'
  106. with_items:
  107. - 'lsof'
  108. - 'unhide'
  109. - 'rkhunter'
  110. when: with_rkhunter
  111. tags:
  112. - 'security'
  113. - name: 'Reconfigure rkhunter package'
  114. debconf:
  115. name: '{{item.name}}'
  116. question: '{{item.question}}'
  117. value: '{{item.value}}'
  118. vtype: '{{item.vtype}}'
  119. with_items:
  120. - { name: 'rkhunter', question: 'rkhunter/apt_autogen', value: 'true', vtype: 'boolean' }
  121. - { name: 'rkhunter', question: 'rkhunter/cron_daily_run', value: 'true', vtype: 'boolean' }
  122. - { name: 'rkhunter', question: 'rkhunter/cron_db_update', value: 'true', vtype: 'boolean' }
  123. notify:
  124. - 'Reconfigure rkhunter'
  125. when: with_rkhunter
  126. tags:
  127. - 'security'
  128. - name: 'Update rkhunter configuration'
  129. template:
  130. src: 'rkhunter/{{ ansible_lsb.codename }}.conf.j2'
  131. dest: '/etc/rkhunter.conf'
  132. owner: 'root'
  133. group: 'root'
  134. mode: '0644'
  135. when: with_rkhunter
  136. tags:
  137. - 'security'
  138. - name: 'Update chkrootkit configuration'
  139. template: src=chkrootkit/chkrootkit.conf.j2 dest=/etc/chkrootkit.conf owner=root group=root mode=0644
  140. when: with_chkrootkit
  141. tags:
  142. - 'security'
  143. - name: 'Update fstab to hide pids from /proc'
  144. lineinfile:
  145. dest: '/etc/fstab'
  146. regexp: '(^proc\s+/proc\s+proc\s+)(\S+)(\s+[0-9]\s+[0-9])\s*$'
  147. line: '\1defaults,hidepid=2\3'
  148. backrefs: 'yes'
  149. notify:
  150. - 'Remount /proc'
  151. when: with_hideproc and hideproc_gid == ''
  152. tags:
  153. - 'security'
  154. - name: 'Update fstab to hide pids from /proc with group id (gid)'
  155. lineinfile:
  156. dest: '/etc/fstab'
  157. regexp: '(^proc\s+/proc\s+proc\s+)(\S+)(\s+[0-9]\s+[0-9])\s*$'
  158. line: '\1defaults,hidepid=2,gid={{hideproc_gid}}\3'
  159. backrefs: 'yes'
  160. notify:
  161. - 'Remount /proc'
  162. when: with_hideproc and hideproc_gid != ''
  163. tags:
  164. - 'security'
  165. - name: 'Create Diffie-Helman parameters'
  166. command: 'openssl dhparam -2 -out /etc/ssl/private/dh{{ item }}.pem {{ item }}'
  167. args:
  168. creates: '/etc/ssl/private/dh{{ item }}.pem'
  169. with_items:
  170. - '2048'
  171. tags:
  172. - 'security'
  173. # vim: ft=yaml.ansible