154 lines
4.1 KiB
YAML
154 lines
4.1 KiB
YAML
---
|
|
|
|
- block:
|
|
- name: Configure hostname
|
|
hostname:
|
|
name: "{{ inventory_hostname_short }}"
|
|
|
|
- name: Configure FQDN
|
|
lineinfile:
|
|
path: /etc/hosts
|
|
regexp: '^127\.0\.0\.1'
|
|
line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname_short }} localhost"
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- name: Choose a DKIM selector
|
|
set_fact:
|
|
dkim_selector: "{{ inventory_hostname | replace('.', '-') }}"
|
|
|
|
- name: Create /etc/exim4/dkim/ directory
|
|
file:
|
|
path: /etc/exim4/dkim/
|
|
state: directory
|
|
mode: 0750
|
|
owner: Debian-exim
|
|
group: Debian-exim
|
|
|
|
- name: Generate a private key for DKIM
|
|
command: openssl genrsa -out /etc/exim4/dkim/{{ dkim_selector }}-private.key 1024
|
|
args:
|
|
creates: /etc/exim4/dkim/{{ dkim_selector }}-private.key
|
|
|
|
- name: Allow exim to read the DKIM private key
|
|
file:
|
|
path: /etc/exim4/dkim/{{ dkim_selector }}-private.key
|
|
owner: root
|
|
group: Debian-exim
|
|
mode: 0640
|
|
|
|
- name: Derive the public key for DKIM
|
|
command: openssl rsa -in {{ dkim_selector }}-private.key -out {{ dkim_selector }}.pem -pubout -outform PEM
|
|
args:
|
|
chdir: /etc/exim4/dkim/
|
|
creates: /etc/exim4/dkim/{{ dkim_selector }}.pem
|
|
|
|
- name: Configure exim to use our DKIM key
|
|
copy:
|
|
dest: /etc/exim4/conf.d/main/00_local_macros
|
|
content: |
|
|
DKIM_CANON = relaxed
|
|
DKIM_SELECTOR = {{ dkim_selector }}
|
|
DKIM_DOMAIN = {{ inventory_hostname }}
|
|
DKIM_PRIVATE_KEY = /etc/exim4/dkim/{{ dkim_selector }}-private.key
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
notify: reload exim4
|
|
register: config_exim
|
|
|
|
- name: Reconfigure exim4
|
|
command: update-exim4.conf
|
|
when: config_exim is changed
|
|
|
|
- package: name=nftables state=present
|
|
|
|
- copy:
|
|
content: |
|
|
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0;
|
|
iif lo accept
|
|
ct state established,related accept
|
|
tcp dport { ssh, http, https, smtp, imap2, imaps} ct state new accept
|
|
{{ nft_extra }}
|
|
counter drop
|
|
}
|
|
}
|
|
|
|
dest: /etc/nftables.conf
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
notify: reload nftables
|
|
|
|
- service: name=nftables enabled=yes state=started daemon_reload=yes
|
|
|
|
- name: Update via apt (mandatory on first run)
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 86400
|
|
|
|
- name: Install some usefull packages
|
|
apt:
|
|
state: present
|
|
name:
|
|
- aptitude
|
|
- emacs-nox
|
|
- fail2ban
|
|
- git
|
|
- htop
|
|
- ncdu
|
|
- ntp
|
|
- python3
|
|
- python3-dev
|
|
- python3-pip
|
|
- python3-setuptools
|
|
- python3-venv
|
|
- python3-wheel
|
|
- rsync
|
|
- sudo
|
|
- tcpdump
|
|
- vim-nox
|
|
|
|
- name: Set some authorized keys
|
|
copy:
|
|
content: "{{ authorized_keys }}"
|
|
dest: /root/.ssh/authorized_keys
|
|
mode: 0600
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Ensure mlocate and locate are not installed
|
|
apt:
|
|
name: ["mlocate", "locate"]
|
|
state: absent
|
|
|
|
# From https://infosec.mozilla.org/guidelines/openssh
|
|
- name: SSHd hardening
|
|
blockinfile:
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK (KexAlgorithms, Ciphers, MACs)"
|
|
path: /etc/ssh/sshd_config
|
|
state: present
|
|
create: true
|
|
block: |
|
|
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
|
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
|
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
|
|
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
HostKey /etc/ssh/ssh_host_ecdsa_key
|
|
|
|
AuthenticationMethods publickey
|
|
LogLevel VERBOSE
|
|
notify: restart sshd
|
|
tags: ssh
|
|
|
|
tags: common
|