mates
da9003aef8
Toto repo ma novou cistou historii (1 commit). Predchozi historie byla smazana, protoze obsahovala osobni udaje (IP, emaily, hesla, klice, tokeny, Volume cesty). Soubory v aktualnim commit uz tyto udaje neobsahuji (nahradeno placeholdery <server-ip>, CHANGE_ME, admin@example.com atd.). Pokud chces zpet kompletni seznam starych commitu, mas je ve svem lokalnim working tree - git log --all ukaze prazdno (protoze jsme smazali .git/ a zacali znovu).
59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
---
|
||
# Security hardening – sysctl, AppArmor, auditd, auto-updates
|
||
#
|
||
# Pouziti:
|
||
# ansible-playbook -i inventory.yml playbooks/security-hardening.yml
|
||
#
|
||
- name: Security hardening
|
||
hosts: homeservers
|
||
become: true
|
||
|
||
tasks:
|
||
- name: Kernel hardening pres sysctl
|
||
ansible.posix.sysctl:
|
||
name: "{{ item.key }}"
|
||
value: "{{ item.value }}"
|
||
state: present
|
||
reload: true
|
||
loop:
|
||
- { key: "net.ipv4.conf.all.rp_filter", value: "1" }
|
||
- { key: "net.ipv4.conf.default.rp_filter", value: "1" }
|
||
- { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
|
||
- { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
|
||
- { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.all.send_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.all.accept_source_route", value: "0" }
|
||
- { key: "net.ipv4.conf.default.accept_source_route", value: "0" }
|
||
- { key: "net.ipv4.tcp_syncookies", value: "1" }
|
||
- { key: "net.ipv4.conf.all.log_martians", value: "1" }
|
||
|
||
- name: Instalace unattended-upgrades
|
||
ansible.builtin.apt:
|
||
name:
|
||
- unattended-upgrades
|
||
- apt-listchanges
|
||
state: present
|
||
|
||
- name: Povol automaticke security updaty
|
||
ansible.builtin.copy:
|
||
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||
content: |
|
||
APT::Periodic::Update-Package-Lists "1";
|
||
APT::Periodic::Unattended-Upgrade "1";
|
||
APT::Periodic::AutocleanInterval "7";
|
||
mode: "0644"
|
||
|
||
- name: Instalace auditd
|
||
ansible.builtin.apt:
|
||
name:
|
||
- auditd
|
||
- audispd-plugins
|
||
state: present
|
||
|
||
- name: Aktivuj auditd
|
||
ansible.builtin.service:
|
||
name: auditd
|
||
state: started
|
||
enabled: true
|