algo/roles/security/tasks/main.yml

## Using a two-pass approach for checking directories in order to support symlinks.
#- name: Find directories for minimizing access
  #stat:
    #path: "{{ item }}"
  #register: minimize_access_directories
  #with_items:
    #- '/usr/local/sbin'
    #- '/usr/local/bin'
    #- '/usr/sbin'
    #- '/usr/bin'
    #- '/sbin'
    #- '/bin'

#- name: Minimize access
  #file: path='{{ item.stat.path }}' mode='go-w' recurse=yes
  #when: item.stat.isdir
  #with_items: "{{ minimize_access_directories.results }}"
  #no_log: True

#- name: Change shadow ownership to root and mode to 0600
  #file: dest='/etc/shadow' owner=root group=root mode=0600

#- name: change su-binary to only be accessible to user and group root
  #file: dest='/bin/su' owner=root group=root mode=0750

#- name: Collect Use of privileged commands
  #shell: >
    #/usr/bin/find {/usr/local/sbin,/usr/local/bin,/sbin,/bin,/usr/sbin,/usr/bin} -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged" }'
  #args:
    #executable: /bin/bash
  #register: privileged_programs

## Rsyslog

#- name: Rsyslog configured
  #template: src=rsyslog.conf.j2 dest=/etc/rsyslog.conf
  #notify:
    #- restart rsyslog

#- name: Rsyslog CIS configured
  #template: src=CIS.conf.j2 dest=/etc/rsyslog.d/CIS.conf owner=root group=root mode=0644
  #notify:
    #- restart rsyslog

#- name: Enable services
  #service: name=rsyslog enabled=yes

## Core dumps

#- name: Restrict core dumps (with PAM)
  #lineinfile: dest=/etc/security/limits.conf line="* hard core 0" state=present

#- name: Restrict core dumps (with sysctl)
  #sysctl: name=fs.suid_dumpable value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present

## Kernel fixes

#- name: Disable Source Routed Packet Acceptance
  #sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  #with_items:
    #- net.ipv4.conf.all.accept_source_route
    #- net.ipv4.conf.default.accept_source_route
  #notify:
    #- flush routing cache

#- name: Disable ICMP Redirect Acceptance
  #sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  #with_items:
    #- net.ipv4.conf.all.accept_redirects
    #- net.ipv4.conf.default.accept_redirects

#- name: Disable Secure ICMP Redirect Acceptance
  #sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  #with_items:
    #- net.ipv4.conf.all.secure_redirects
    #- net.ipv4.conf.default.secure_redirects
  #notify:
    #- flush routing cache

#- name: Enable Bad Error Message Protection
  #sysctl: name=net.ipv4.icmp_ignore_bogus_error_responses value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  #notify:
    #- flush routing cache

#- name: Enable RFC-recommended Source Route Validation
  #sysctl: name="{{item}}" value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  #with_items:
    #- net.ipv4.conf.all.rp_filter
    #- net.ipv4.conf.default.rp_filter
  #notify:
    #- flush routing cache

#- name: Enable packet forwarding for IPv4
  #sysctl: name=net.ipv4.ip_forward value=1

#- name: Enable packet forwarding for IPv6
  #sysctl: name=net.ipv6.conf.all.forwarding value=1

#- name: Do not send ICMP redirects (we are not a router)
  #sysctl: name=net.ipv4.conf.all.send_redirects value=0

- name: Iptables configured
  template: src="{{ item.src }}" dest="{{ item.dest }}" owner=root group=root mode=0640
  with_items:
    - { src: rules.v4.j2, dest: /etc/iptables/rules.v4 }
    - { src: rules.v6.j2, dest: /etc/iptables/rules.v6 }  
  notify:
  - restart iptables