mates
444191d16d
- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower) - install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore - ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton - hermes-install: Hermes CLI setup on macOS - macos-setup: Brewfile + osx-defaults + fish-config - home-nas-tools: metadata index for NAS projects (no binaries) - docs: architecture, security, contributing - README, LICENSE (MIT), .gitignore
59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
---
|
||
# Security hardening – sysctl, AppArmor, auditd, auto-updates
|
||
#
|
||
# Použití:
|
||
# ansible-playbook -i inventory.yml playbooks/security-hardening.yml
|
||
#
|
||
- name: Security hardening
|
||
hosts: homeservers
|
||
become: true
|
||
|
||
tasks:
|
||
- name: Kernel hardening via sysctl
|
||
ansible.posix.sysctl:
|
||
name: "{{ item.key }}"
|
||
value: "{{ item.value }}"
|
||
state: present
|
||
reload: true
|
||
loop:
|
||
- { key: "net.ipv4.conf.all.rp_filter", value: "1" }
|
||
- { key: "net.ipv4.conf.default.rp_filter", value: "1" }
|
||
- { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
|
||
- { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
|
||
- { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.all.send_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.all.accept_source_route", value: "0" }
|
||
- { key: "net.ipv4.conf.default.accept_source_route", value: "0" }
|
||
- { key: "net.ipv4.tcp_syncookies", value: "1" }
|
||
- { key: "net.ipv4.conf.all.log_martians", value: "1" }
|
||
|
||
- name: Install unattended-upgrades
|
||
ansible.builtin.apt:
|
||
name:
|
||
- unattended-upgrades
|
||
- apt-listchanges
|
||
state: present
|
||
|
||
- name: Enable automatic security updates
|
||
ansible.builtin.copy:
|
||
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||
content: |
|
||
APT::Periodic::Update-Package-Lists "1";
|
||
APT::Periodic::Unattended-Upgrade "1";
|
||
APT::Periodic::AutocleanInterval "7";
|
||
mode: "0644"
|
||
|
||
- name: Install auditd
|
||
ansible.builtin.apt:
|
||
name:
|
||
- auditd
|
||
- audispd-plugins
|
||
state: present
|
||
|
||
- name: Enable auditd
|
||
ansible.builtin.service:
|
||
name: auditd
|
||
state: started
|
||
enabled: true
|