Archives/algo
2
0
Fork 0
mirror of https://github.com/trailofbits/algo synced 2024-11-13 19:12:06 +00:00
Code Issues Projects Releases Wiki Activity
e78df40468
algo/docs/setup-roles.md
Jack Ivanov a7b06058cb remove the proxy role #440 (#457) 
* remove the proxy role #440

* Separate facts. Make roles more independent from each other

move openssl to local tasks

move unneeded tasks
2017-04-20 18:00:17 -04:00

1.6 KiB
Raw Blame History

Ansible Roles

Required roles

  • Common
    • Installs several required packages and software updates, then reboots if necessary
    • Configures network interfaces, and enables packet forwarding on them
  • VPN
    • Installs strongSwan, enables AppArmor, limits CPU and memory access, and drops user privileges
    • Builds a Certificate Authority (CA) with easy-rsa-ipsec and creates one client certificate per user
    • Bundles the appropriate certificates into Apple mobileconfig profiles for each user
    • Configures IPtables to block traffic that might pose a risk to VPN users, such as SMB/CIFS

Optional roles

  • Security Enhancements
    • Enables unattended-upgrades to ensure available patches are always applied
    • Modify features like core dumps, kernel parameters, and SUID binaries to limit possible attacks
    • Enhances SSH with modern ciphers and seccomp, and restricts access to old or unwanted features like X11 forwarding and SFTP
  • DNS-based Adblocking
    • Install the dnsmasq local resolver with a blacklist for advertising domains
    • Constrains dnsmasq with AppArmor and cgroups CPU and memory limitations
  • SSH Tunneling
    • Adds a restricted algo group with no shell access and limited SSH forwarding options
    • Creates one limited, local account per user and an SSH public key for each