security.yml 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145
  1. - name: 'Install auto upgrades package'
  2. apt:
  3. pkg: 'unattended-upgrades'
  4. state: 'present'
  5. when: with_auto_upgrade
  6. - name: 'Reconfigure unattended-upgrades package'
  7. debconf:
  8. name: 'unattended-upgrades'
  9. question: 'unattended-upgrades/enable_auto_updates'
  10. value: 'true'
  11. vtype: 'boolean'
  12. notify:
  13. - 'Reconfigure unattended-upgrades'
  14. when: with_auto_upgrade
  15. - name: 'Update unattended-upgrades configuration'
  16. template:
  17. src: '{{ item }}'
  18. dest: '/etc/apt/apt.conf.d/90unattended-upgrades-local'
  19. owner: 'root'
  20. group: 'root'
  21. mode: '0644'
  22. with_first_found:
  23. - 'apt/auto-upgrades.{{ ansible_lsb.codename }}.j2'
  24. - 'apt/auto-upgrades.j2'
  25. when: with_auto_upgrade
  26. - name: 'Install logcheck packages'
  27. apt:
  28. pkg: '{{ item }}'
  29. state: 'present'
  30. with_items:
  31. - 'logcheck'
  32. - 'logcheck-database'
  33. when: with_logcheck
  34. - name: 'Install local configuration files for logcheck'
  35. copy:
  36. src: 'logcheck/{{ item }}_local'
  37. dest: '/etc/logcheck/ignore.d.server/{{ item }}_local'
  38. owner: 'root'
  39. group: 'logcheck'
  40. mode: '0644'
  41. with_items:
  42. - 'amavisd-new'
  43. - 'ansible'
  44. - 'apache2'
  45. - 'bind'
  46. - 'dhclient'
  47. - 'dnsmasq'
  48. - 'dovecot'
  49. - 'dropbear'
  50. - 'ferm'
  51. - 'gammu'
  52. - 'git-daemon'
  53. - 'gogs'
  54. - 'influxd'
  55. - 'ipmi'
  56. - 'irqbalance'
  57. - 'kernel'
  58. - 'libpam-modules'
  59. - 'mon'
  60. - 'noip2'
  61. - 'ntp'
  62. - 'openvpn'
  63. - 'opendkim'
  64. - 'php'
  65. - 'postfix'
  66. - 'pure-ftpd'
  67. - 'pve-cluster'
  68. - 'redir'
  69. - 'rpc-mountd'
  70. - 'rrdcached'
  71. - 'rsyslog'
  72. - 'smartd'
  73. - 'spamd'
  74. - 'sshd'
  75. - 'svn'
  76. - 'sympa'
  77. - 'systemd'
  78. - 'zabbix-agentd'
  79. when: with_logcheck
  80. tags:
  81. - 'logcheck'
  82. - name: 'Update logcheck cron job'
  83. template:
  84. src: 'cron/logcheck.j2'
  85. dest: '/etc/cron.d/logcheck'
  86. owner: 'root'
  87. group: 'root'
  88. mode: '0644'
  89. when: with_logcheck
  90. - name: 'Install rkhunter related packages'
  91. apt:
  92. pkg: '{{ item }}'
  93. state: 'present'
  94. with_items:
  95. - 'lsof'
  96. - 'unhide'
  97. - 'rkhunter'
  98. when: with_rkhunter
  99. - name: 'Reconfigure rkhunter package'
  100. debconf:
  101. name: '{{item.name}}'
  102. question: '{{item.question}}'
  103. value: '{{item.value}}'
  104. vtype: '{{item.vtype}}'
  105. with_items:
  106. - { name: 'rkhunter', question: 'rkhunter/apt_autogen', value: 'true', vtype: 'boolean' }
  107. - { name: 'rkhunter', question: 'rkhunter/cron_daily_run', value: 'true', vtype: 'boolean' }
  108. - { name: 'rkhunter', question: 'rkhunter/cron_db_update', value: 'true', vtype: 'boolean' }
  109. notify:
  110. - 'Reconfigure rkhunter'
  111. when: with_rkhunter
  112. - name: Update rkhunter configuration
  113. template: src=rkhunter/{{ ansible_lsb.codename }}.conf.j2 dest=/etc/rkhunter.conf owner=root group=root mode=0644
  114. when: with_rkhunter
  115. - name: Update chkrootkit configuration
  116. template: src=chkrootkit/chkrootkit.conf.j2 dest=/etc/chkrootkit.conf owner=root group=root mode=0644
  117. when: with_chkrootkit
  118. - name: Update fstab to hide pids from /proc
  119. lineinfile: dest=/etc/fstab regexp='(^proc\s+/proc\s+proc\s+)(\S+)(\s+[0-9]\s+[0-9])\s*$' line='\1defaults,hidepid=2\3' backrefs=yes
  120. notify:
  121. - Remount /proc
  122. when: with_hideproc and hideproc_gid == ''
  123. - name: Update fstab to hide pids from /proc with group id (gid)
  124. lineinfile: dest=/etc/fstab regexp='(^proc\s+/proc\s+proc\s+)(\S+)(\s+[0-9]\s+[0-9])\s*$' line='\1defaults,hidepid=2,gid={{hideproc_gid}}\3' backrefs=yes
  125. notify:
  126. - Remount /proc
  127. when: with_hideproc and hideproc_gid != ''
  128. - name: 'Create Diffie-Helman parameters'
  129. command: 'openssl dhparam -2 -out /etc/ssl/private/dh{{ item }}.pem {{ item }}'
  130. args:
  131. creates: '/etc/ssl/private/dh{{ item }}.pem'
  132. with_items:
  133. - '2048'