forked from AFPy/infra
113 lines
3.0 KiB
YAML
113 lines
3.0 KiB
YAML
---
|
|
|
|
- block:
|
|
- name: Configure hostname
|
|
hostname:
|
|
name: "{{ inventory_hostname_short }}"
|
|
|
|
- name: Configure FQDN
|
|
lineinfile:
|
|
path: /etc/hosts
|
|
regexp: '^127\.0\.0\.1'
|
|
line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname_short }} localhost"
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- package: name=nftables state=present
|
|
|
|
- name: Copy nftables rules
|
|
copy:
|
|
content: |
|
|
#!/usr/sbin/nft -f
|
|
|
|
table inet filter
|
|
flush table inet filter
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0;
|
|
iif lo accept
|
|
ct state established,related accept
|
|
icmp type echo-request counter accept
|
|
icmpv6 type echo-request counter accept
|
|
|
|
# accept neighbour discovery otherwise connectivity breaks:
|
|
icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
|
|
tcp dport { ssh, http, https, smtp, imap2, imaps} ct state new accept
|
|
{{ nft_extra }}
|
|
counter drop
|
|
}
|
|
}
|
|
|
|
dest: /etc/nftables.conf
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
notify: reload nftables
|
|
|
|
- service: name=nftables enabled=yes state=started daemon_reload=yes
|
|
|
|
- name: Update via apt (mandatory on first run)
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 86400
|
|
|
|
- name: Install some usefull packages
|
|
apt:
|
|
state: present
|
|
name:
|
|
- aptitude
|
|
- emacs-nox
|
|
- fail2ban
|
|
- git
|
|
- htop
|
|
- ncdu
|
|
- ntp
|
|
- python3
|
|
- python3-dev
|
|
- python3-pip
|
|
- python3-setuptools
|
|
- python3-venv
|
|
- python3-wheel
|
|
- rsync
|
|
- sudo
|
|
- tcpdump
|
|
- vim-nox
|
|
|
|
- name: Set some authorized keys
|
|
copy:
|
|
content: "{{ authorized_keys }}"
|
|
dest: /root/.ssh/authorized_keys
|
|
mode: 0600
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Ensure mlocate and locate are not installed
|
|
apt:
|
|
name: ["mlocate", "locate"]
|
|
state: absent
|
|
|
|
# From https://infosec.mozilla.org/guidelines/openssh
|
|
- name: SSHd hardening
|
|
blockinfile:
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK (KexAlgorithms, Ciphers, MACs)"
|
|
path: /etc/ssh/sshd_config
|
|
state: present
|
|
create: true
|
|
block: |
|
|
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
|
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
|
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
|
|
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
HostKey /etc/ssh/ssh_host_ecdsa_key
|
|
|
|
AuthenticationMethods publickey
|
|
LogLevel VERBOSE
|
|
notify: restart sshd
|
|
tags: ssh
|
|
|
|
tags: common
|