algo/roles/security/tasks/main.yml

- name: Install tools
  apt: name="{{ item }}" state=latest
  with_items:
    - unattended-upgrades

- name: Configure unattended-upgrades
  template: src=50unattended-upgrades.j2 dest=/etc/apt/apt.conf.d/50unattended-upgrades owner=root group=root mode=0644

- name: Periodic upgrades configured
  template: src=10periodic.j2 dest=/etc/apt/apt.conf.d/10periodic owner=root group=root mode=0644

- name: Find directories for minimizing access
  stat:
    path: "{{ item }}"
  register: minimize_access_directories
  with_items:
    - '/usr/local/sbin'
    - '/usr/local/bin'
    - '/usr/sbin'
    - '/usr/bin'
    - '/sbin'
    - '/bin'

- name: Minimize access
  file: path='{{ item.stat.path }}' mode='go-w' recurse=yes
  when: item.stat.isdir
  with_items: "{{ minimize_access_directories.results }}"
  no_log: True

- name: Change shadow ownership to root and mode to 0600
  file: dest='/etc/shadow' owner=root group=root mode=0600

- name: change su-binary to only be accessible to user and group root
  file: dest='/bin/su' owner=root group=root mode=0750

- name: Collect Use of privileged commands
  shell: >
    /usr/bin/find {/usr/local/sbin,/usr/local/bin,/sbin,/bin,/usr/sbin,/usr/bin} -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged" }'
  args:
    executable: /bin/bash
  register: privileged_programs

# Core dumps

- name: Restrict core dumps (with PAM)
  lineinfile: dest=/etc/security/limits.conf line="* hard core 0" state=present

- name: Restrict core dumps (with sysctl)
  sysctl: name=fs.suid_dumpable value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present

# Kernel fixes

- name: Disable Source Routed Packet Acceptance
  sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  with_items:
    - net.ipv4.conf.all.accept_source_route
    - net.ipv4.conf.default.accept_source_route
  notify:
    - flush routing cache

- name: Disable ICMP Redirect Acceptance
  sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  with_items:
    - net.ipv4.conf.all.accept_redirects
    - net.ipv4.conf.default.accept_redirects

- name: Disable Secure ICMP Redirect Acceptance
  sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  with_items:
    - net.ipv4.conf.all.secure_redirects
    - net.ipv4.conf.default.secure_redirects
  notify:
    - flush routing cache

- name: Enable Bad Error Message Protection
  sysctl: name=net.ipv4.icmp_ignore_bogus_error_responses value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  notify:
    - flush routing cache

- name: Enable RFC-recommended Source Route Validation
  sysctl: name="{{item}}" value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
  with_items:
    - net.ipv4.conf.all.rp_filter
    - net.ipv4.conf.default.rp_filter
  notify:
    - flush routing cache

- name: Do not send ICMP redirects (we are not a router)
  sysctl: name=net.ipv4.conf.all.send_redirects value=0

- name: SSH config
  template: src=sshd_config.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0644
  notify:
    - restart ssh