security.yml 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140
  1. - name: 'Install auto upgrades package'
  2. apt:
  3. pkg: 'unattended-upgrades'
  4. state: 'installed'
  5. when: with_auto_upgrade
  6. - name: 'Reconfigure unattended-upgrades package'
  7. debconf:
  8. name: 'unattended-upgrades'
  9. question: 'unattended-upgrades/enable_auto_updates'
  10. value: 'true'
  11. vtype: 'boolean'
  12. notify:
  13. - 'Reconfigure unattended-upgrades'
  14. when: with_auto_upgrade
  15. - name: 'Update unattended-upgrades configuration'
  16. template:
  17. src: '{{ item }}'
  18. dest: '/etc/apt/apt.conf.d/90unattended-upgrades-local'
  19. owner: 'root'
  20. group: 'root'
  21. mode: '0644'
  22. with_first_found:
  23. - 'apt/auto-upgrades.{{ ansible_lsb.codename }}.j2'
  24. - 'apt/auto-upgrades.j2'
  25. when: with_auto_upgrade
  26. - name: 'Install logcheck packages'
  27. apt:
  28. pkg: '{{ item }}'
  29. state: 'installed'
  30. with_items:
  31. - 'logcheck'
  32. - 'logcheck-database'
  33. when: with_logcheck
  34. - name: 'Install local configuration files for logcheck'
  35. copy:
  36. src: 'logcheck/{{ item }}_local'
  37. dest: '/etc/logcheck/ignore.d.server/{{ item }}_local'
  38. owner: 'root'
  39. group: 'root'
  40. mode: '0644'
  41. with_items:
  42. - 'amavisd-new'
  43. - 'ansible'
  44. - 'apache2'
  45. - 'bind'
  46. - 'dhclient'
  47. - 'dnsmasq'
  48. - 'dovecot'
  49. - 'dropbear'
  50. - 'ferm'
  51. - 'git-daemon'
  52. - 'gogs'
  53. - 'ipmi'
  54. - 'irqbalance'
  55. - 'kernel'
  56. - 'libpam-modules'
  57. - 'mon'
  58. - 'noip2'
  59. - 'ntp'
  60. - 'openvpn'
  61. - 'php'
  62. - 'postfix'
  63. - 'pure-ftpd'
  64. - 'pve-cluster'
  65. - 'redir'
  66. - 'rpc-mountd'
  67. - 'rrdcached'
  68. - 'rsyslog'
  69. - 'smartd'
  70. - 'spamd'
  71. - 'sshd'
  72. - 'svn'
  73. - 'sympa'
  74. - 'systemd'
  75. - 'zabbix-agentd'
  76. when: with_logcheck
  77. - name: 'Update logcheck cron job'
  78. template:
  79. src: 'cron/logcheck.j2'
  80. dest: '/etc/cron.d/logcheck'
  81. owner: 'root'
  82. group: 'root'
  83. mode: '0644'
  84. when: with_logcheck
  85. - name: 'Install rkhunter related packages'
  86. apt:
  87. pkg: '{{ item }}'
  88. state: 'installed'
  89. with_items:
  90. - 'lsof'
  91. - 'unhide'
  92. - 'rkhunter'
  93. when: with_rkhunter
  94. - name: 'Reconfigure rkhunter package'
  95. debconf:
  96. name: '{{item.name}}'
  97. question: '{{item.question}}'
  98. value: '{{item.value}}'
  99. vtype: '{{item.vtype}}'
  100. with_items:
  101. - { name: 'rkhunter', question: 'rkhunter/apt_autogen', value: 'true', vtype: 'boolean' }
  102. - { name: 'rkhunter', question: 'rkhunter/cron_daily_run', value: 'true', vtype: 'boolean' }
  103. - { name: 'rkhunter', question: 'rkhunter/cron_db_update', value: 'true', vtype: 'boolean' }
  104. notify:
  105. - 'Reconfigure rkhunter'
  106. when: with_rkhunter
  107. - name: Update rkhunter configuration
  108. template: src=rkhunter/{{ ansible_lsb.codename }}.conf.j2 dest=/etc/rkhunter.conf owner=root group=root mode=0644
  109. when: with_rkhunter
  110. - name: Update chkrootkit configuration
  111. template: src=chkrootkit/chkrootkit.conf.j2 dest=/etc/chkrootkit.conf owner=root group=root mode=0644
  112. when: with_chkrootkit
  113. - name: Update fstab to hide pids from /proc
  114. lineinfile: dest=/etc/fstab regexp='(^proc\s+/proc\s+proc\s+)(\S+)(\s+[0-9]\s+[0-9])\s*$' line='\1defaults,hidepid=2\3' backrefs=yes
  115. notify:
  116. - Remount /proc
  117. when: with_hideproc and hideproc_gid == ''
  118. - name: Update fstab to hide pids from /proc with group id (gid)
  119. lineinfile: dest=/etc/fstab regexp='(^proc\s+/proc\s+proc\s+)(\S+)(\s+[0-9]\s+[0-9])\s*$' line='\1defaults,hidepid=2,gid={{hideproc_gid}}\3' backrefs=yes
  120. notify:
  121. - Remount /proc
  122. when: with_hideproc and hideproc_gid != ''
  123. - name: 'Create Diffie-Helman parameters'
  124. command: 'openssl dhparam -2 -out /etc/ssl/private/dh{{ item }}.pem {{ item }}'
  125. args:
  126. creates: '/etc/ssl/private/dh{{ item }}.pem'
  127. with_items:
  128. - '2048'