mirror of https://github.com/trailofbits/algo
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
84 lines
2.6 KiB
YAML
84 lines
2.6 KiB
YAML
---
|
|
|
|
- name: Gather Facts
|
|
setup:
|
|
|
|
- name: Install software updates
|
|
apt: update_cache=yes upgrade=dist
|
|
|
|
- name: Check if reboot is required
|
|
shell: >
|
|
if [[ $(readlink -f /vmlinuz) != /boot/vmlinuz-$(uname -r) ]]; then echo "required"; else echo "no"; fi
|
|
args:
|
|
executable: /bin/bash
|
|
register: reboot_required
|
|
|
|
- name: Reboot
|
|
shell: sleep 2 && shutdown -r now "Ansible updates triggered"
|
|
async: 1
|
|
poll: 0
|
|
when: reboot_required is defined and reboot_required.stdout == 'required'
|
|
ignore_errors: true
|
|
|
|
- name: Wait for shutdown
|
|
local_action: wait_for host={{ inventory_hostname }} port=22 state=stopped timeout=120
|
|
when: reboot_required is defined and reboot_required.stdout == 'required'
|
|
become: false
|
|
|
|
- name: Wait until SSH becomes ready...
|
|
local_action: wait_for host={{ inventory_hostname }} port=22 state=started timeout=120
|
|
when: reboot_required is defined and reboot_required.stdout == 'required'
|
|
become: false
|
|
|
|
- name: SSH config
|
|
template: src=sshd_config.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0644
|
|
notify:
|
|
- restart ssh
|
|
|
|
- name: Disable MOTD on login and SSHD
|
|
replace: dest="{{ item.file }}" regexp="{{ item.regexp }}" replace="{{ item.line }}"
|
|
with_items:
|
|
- { regexp: '^session.*optional.*pam_motd.so.*', line: '# MOTD DISABLED', file: '/etc/pam.d/login' }
|
|
- { regexp: '^session.*optional.*pam_motd.so.*', line: '# MOTD DISABLED', file: '/etc/pam.d/sshd' }
|
|
|
|
- name: Install tools
|
|
apt: name="{{ item }}" state=latest
|
|
with_items:
|
|
- git
|
|
- screen
|
|
- apparmor-utils
|
|
- uuid-runtime
|
|
- coreutils
|
|
- rsyslog
|
|
- sendmail
|
|
- unattended-upgrades
|
|
- iptables-persistent
|
|
- cgroup-tools
|
|
|
|
- name: Configure unattended-upgrades
|
|
template: src=50unattended-upgrades.j2 dest=/etc/apt/apt.conf.d/50unattended-upgrades owner=root group=root mode=0644
|
|
|
|
- name: Periodic upgrades configured
|
|
template: src=10periodic.j2 dest=/etc/apt/apt.conf.d/10periodic owner=root group=root mode=0644
|
|
|
|
- name: Loopback for services configured
|
|
template: src=10-loopback-services.cfg.j2 dest=/etc/network/interfaces.d/10-loopback-services.cfg
|
|
notify:
|
|
- restart loopback
|
|
|
|
- name: Loopback included into the network config
|
|
lineinfile: dest=/etc/network/interfaces line='source /etc/network/interfaces.d/10-loopback-services.cfg' state=present
|
|
notify:
|
|
- restart loopback
|
|
|
|
- meta: flush_handlers
|
|
|
|
- name: Enable packet forwarding for IPv4
|
|
sysctl: name="{{ item }}" value=1
|
|
with_items:
|
|
- net.ipv4.ip_forward
|
|
- net.ipv4.conf.all.forwarding
|
|
|
|
- name: Enable packet forwarding for IPv6
|
|
sysctl: name=net.ipv6.conf.all.forwarding value=1
|