added the a preparing ansible playbooks for automating new servers

2026-08-23 22:11:09 +03:30
parent e8422c0006
commit aedfdbddb7
73 changed files with 2971 additions and 44 deletions
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/files/limits.conf
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/files/limits.conf
@@ -0,0 +1,8 @@
+root soft nofile 65535
+root hard nofile 65535
+root soft nproc  65535
+root hard nproc  65535
+*    soft nofile 2048
+*    hard nofile 2048
+*    soft nproc  2048
+*    hard nproc  2048
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/files/ssh_banner
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/files/ssh_banner
@@ -0,0 +1,10 @@
+#################################################################
+#                            ALERT                              #
+#  You are entering into a secured area! Your IP, Login Time,   #
+#   Username has been noted and has been sent to the server     #
+#                       administrator!                          #
+#   This service is restricted to authorized users only. All    #
+#            activities on this system are logged.              #
+#  Unauthorized access will be fully investigated and reported  #
+#        to the appropriate law enforcement agencies.           #
+#################################################################
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/handlers/main.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/handlers/main.yaml
@@ -0,0 +1,39 @@
+- name: Restart ssh
+  systemd:
+    name: ssh
+    state: restarted
+
+- name: Restart iptables
+  systemd:
+    name: iptables
+    state: restarted
+
+- name: Restart fail2ban
+  systemd:
+    name: fail2ban
+    state: restarted
+
+- name: Restart ntp
+  systemd:
+    name: ntp
+    state: restarted
+
+# https://github.com/ansible/ansible/issues/22171
+- name: restart auditd
+  become: 'yes'
+  ansible.builtin.command: service auditd restart
+  args:
+    warn: false
+
+- name: generate auditd
+  become: 'yes'
+  ansible.builtin.command: augenrules --load
+
+- name: reload systemd
+  become: 'yes'
+  ansible.builtin.systemd:
+    daemon_reload: 'yes'
+
+- name: update cracklib debian
+  become: 'yes'
+  ansible.builtin.command: update-cracklib
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/auditd.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/auditd.yml
@@ -0,0 +1,116 @@
+---
+- name: set Debian audit grub cmdline
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX {{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"'
+    dest: /etc/default/grub.d/99-hardening-audit.cfg
+    state: present
+    create: 'yes'
+    mode: 0755
+    owner: root
+    group: root
+
+- name: set audit action_mail_acct
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^action_mail_acct ="
+    line: "action_mail_acct = {{ auditd_action_mail_acct }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit admin_space_left_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^admin_space_left_action = "
+    line: "admin_space_left_action = {{ auditd_admin_space_left_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit disk_error_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^disk_error_action ="
+    line: "disk_error_action = {{ auditd_disk_error_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit disk_full_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^disk_full_action ="
+    line: "disk_full_action = {{ auditd_disk_full_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit max_log_file
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^max_log_file ="
+    line: "max_log_file = {{ auditd_max_log_file }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit max_log_file_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^max_log_file_action ="
+    line: "max_log_file_action = {{ auditd_max_log_file_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit num_logs
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^num_logs ="
+    line: "num_logs = {{ auditd_num_logs }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit space_left
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^space_left ="
+    line: "space_left = {{ auditd_space_left }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit space_left_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^space_left_action ="
+    line: "space_left_action = {{ auditd_space_left_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: audit.rules
+  become: 'yes'
+  ansible.builtin.template:
+    src: hardening.rules.j2
+    dest: /etc/audit/rules.d/hardening.rules
+    backup: 'yes'
+    mode: 0600
+    owner: root
+    group: root
+  when: auditd_apply_audit_rules|bool
+  notify:
+    - generate auditd
+    - restart auditd
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/fstab.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/fstab.yml
@@ -0,0 +1,18 @@
+---
+- name: remove /tmp from fstab
+  become: 'yes'
+  mount:
+    path: /tmp
+    state: absent
+  tags:
+    - fstab
+
+- name: remove floppy from fstab
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    path: /etc/fstab
+    state: absent
+    regexp: '^(.*)floppy(.*)$'
+  tags:
+    - fstab
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hardening.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hardening.yaml
@@ -0,0 +1,55 @@
+---
+- name: Stop and Disable ufw service if started
+  ansible.builtin.service:
+    name: ufw
+    state: stopped
+    enabled: no
+  ignore_errors: yes   # not installed on this box (confirmed: ufw: command not found)
+
+- name: Stop and Disable postfix service if started
+  ansible.builtin.service:
+    name: postfix
+    state: stopped
+    enabled: no
+  ignore_errors: yes
+
+- name: Make timout configuration file.
+  template:
+    src: timout.j2
+    dest: /etc/profile.d/timout-settings.sh
+
+- name: Set timezone to Asia/Tehran
+  community.general.timezone:
+    name: Asia/Tehran
+  notify: Restart ntp
+
+- name: Copy ssh banner file.
+  copy:
+    src: ssh_banner
+    dest: /etc/issue
+
+- name: Make sshd configuration file.
+  template:
+    src: sshd_config.j2
+    dest: /etc/ssh/sshd_config
+  notify: Restart ssh
+
+
+
+- name: Make iptables configuration file.
+  template:
+    src: iptables.j2
+    dest: /etc/iptables/rules.v4
+
+- name: restore iptables state from a file
+  community.general.iptables_state:
+    state: restored
+    path: /etc/iptables/rules.v4
+    noflush: true
+  notify: Restart iptables
+
+- name: Make fail2ban configuration file.
+  template:
+    src: fial2ban.j2
+    dest: /etc/fail2ban/jail.local
+  notify: Restart fail2ban
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hosts.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hosts.yml
@@ -0,0 +1,21 @@
+---
+- name: hosts.allow
+  become: 'yes'
+  ansible.builtin.template:
+    src: hosts.allow.j2
+    dest: /etc/hosts.allow
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+
+- name: hosts.deny
+  become: 'yes'
+  ansible.builtin.template:
+    src: hosts.deny.j2
+    dest: /etc/hosts.deny
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/journalconf.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/journalconf.yml
@@ -0,0 +1,68 @@
+---
+- name: systemd journald.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: journald.conf.j2
+    dest: /etc/systemd/journald.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+  notify:
+    - reload systemd
+
+- name: logrotate.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: logrotate.conf.j2
+    dest: /etc/logrotate.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+
+- name: cron.daily logrotate
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    line: "/usr/sbin/logrotate /etc/logrotate.conf"
+    dest: /etc/cron.daily/logrotate
+    mode: 0750
+    state: present
+    create: 'yes'
+
+- name: stat rsyslog.conf
+  become: 'yes'
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: rsyslogconf
+
+- name: get rsyslog.conf FileCreateMode
+  become: 'yes'
+  environment:
+    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  ansible.builtin.shell: grep "^$FileCreateMode" /etc/rsyslog.conf
+  register: rsyslog_filecreatemode
+  changed_when: false
+  when: rsyslogconf.stat.exists
+
+- name: set rsyslog.conf FileCreateMode
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: '^\$FileCreateMode'
+    line: '$FileCreateMode 0600'
+    dest: /etc/rsyslog.conf
+    mode: 0640
+    state: present
+    create: 'no'
+  when: rsyslogconf.stat.exists and rsyslog_filecreatemode.stdout.find('FileCreateMode') != -1
+
+- name: set rsyslog.d FileCreateMode
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: '^\$FileCreateMode'
+    line: '$FileCreateMode 0600'
+    dest: /etc/rsyslog.d/99-filecreatemode.conf
+    mode: 0644
+    state: present
+    create: 'yes'
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/limits.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/limits.yml
@@ -0,0 +1,21 @@
+---
+- name: limits.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: limits.conf.j2
+    dest: /etc/security/limits.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+
+- name: coredump.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: coredump.conf.j2
+    dest: /etc/systemd/coredump.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/lynis.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/lynis.yaml
@@ -0,0 +1,7 @@
+---
+- name: Install lynis from Debian repo
+  apt:
+    name: lynis
+    state: present
+    update_cache: yes
+  tags: lynis
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/main.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/main.yaml
@@ -0,0 +1,40 @@
+---
+- name: install package
+  import_tasks: packages.yaml
+  tags: install_packages
+
+- name: change limit.conf
+  import_tasks: limits.yml
+  tags: tuning
+
+- name: configure sshd, iptabels and ...
+  import_tasks: hardening.yaml
+  tags: hardening, firewall
+
+- name: host file configure
+  import_tasks: hosts.yml
+  tags: hardening
+
+- name: audit log configure
+  import_tasks: auditd.yml
+  tags: hardening
+
+- name: fstab config
+  import_tasks: fstab.yml
+  tags: hardening
+
+- name: change resolved.conf
+  import_tasks: resolvedconf.yml
+  tags: hardening
+
+- name: change journal.conf
+  import_tasks: journalconf.yml
+  tags: hardening
+
+- name: change sysctl.conf
+  import_tasks: tuning.yaml
+  tags: tuning
+
+- name: download and config lynis scripts
+  import_tasks: lynis.yaml
+  tags: audit
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/packages.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/packages.yaml
@@ -0,0 +1,33 @@
+---
+- name: Update apt cache (no full-system/kernel upgrade — avoids grub-pc + shared-folder breakage)
+  apt:
+    update_cache: yes
+    cache_valid_time: 86400
+- name: Stop systemd-timesyncd (conflicts with the ntp package below)
+  ansible.builtin.systemd:
+    name: systemd-timesyncd
+    state: stopped
+    enabled: no
+  ignore_errors: yes
+
+- name: Remove systemd-timesyncd so ntp can install cleanly
+  apt:
+    name: systemd-timesyncd
+    state: absent
+  ignore_errors: yes
+
+- name: Install basic tools
+  apt:
+    name: "{{ packages }}"
+    state: present
+    force_apt_get: yes
+    update_cache: yes
+
+- name: Set hostname
+  hostname:
+    name: '{{ inventory_hostname }}'
+
+- name: Fix /etc/hosts
+  template:
+    src: "hosts.j2"
+    dest: "/etc/hosts"
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/resolvedconf.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/resolvedconf.yml
@@ -0,0 +1,22 @@
+---
+- name: resolved.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: resolved.conf.j2
+    dest: /etc/systemd/resolved.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+  notify:
+    - reload systemd
+
+- name: resolv.conf
+  become: 'yes'
+  template:
+    src: resolv.conf.j2
+    dest: /etc/resolv.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/tuning.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/tuning.yaml
@@ -0,0 +1,15 @@
+---
+- name: Add the br_netfilter module
+  community.general.modprobe:
+    name: br_netfilter
+    state: present
+
+- name: Change various sysctl-settings
+  sysctl:
+    name: "{{ item.key }}"
+    state: present
+    value: "{{ item.value }}"
+    sysctl_file: /etc/sysctl.d/MeCan.conf
+    reload: yes
+    ignoreerrors: yes
+  with_dict: '{{ sysctl_config }}'
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/coredump.conf.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/coredump.conf.j2
@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+
+[Coredump]
+Storage=none
+ProcessSizeMax=0
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/fial2ban.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/fial2ban.j2
@@ -0,0 +1,882 @@
+# WARNING: heavily refactored in 0.9.0 release.  Please review and
+#          customize settings for your setup.
+#
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in jail.local file,
+#           or separate .conf files under jail.d/ directory, e.g.:
+#
+# HOW TO ACTIVATE JAILS:
+#
+# YOU SHOULD NOT MODIFY THIS FILE.
+#
+# It will probably be overwritten or improved in a distribution update.
+#
+# Provide customizations in a jail.local file or a jail.d/customisation.local.
+# For example to change the default bantime for all jails and to enable the
+# ssh-iptables jail the following (uncommented) would appear in the .local file.
+# See man 5 jail.conf for details.
+#
+# [DEFAULT]
+# bantime = 1h
+#
+# [sshd]
+# enabled = true
+#
+# See jail.conf(5) man page for more information
+
+
+
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
+
+
+[INCLUDES]
+
+#before = paths-distro.conf
+before = paths-debian.conf
+
+# The DEFAULT allows a global definition of the options. They can be overridden
+# in each jail afterwards.
+
+[DEFAULT]
+
+#
+# MISCELLANEOUS OPTIONS
+#
+
+# "ignorself" specifies whether the local resp. own IP addresses should be ignored
+# (default is true). Fail2ban will not ban a host which matches such addresses.
+#ignorself = true
+
+# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
+# will not ban a host which matches an address in this list. Several addresses
+# can be defined using space (and/or comma) separator.
+ignoreip = 127.0.0.1/8 ::1 10.0.2.0/24
+
+# External command that will take an tagged arguments to ignore, e.g. <ip>,
+# and return true if the IP is to be ignored. False otherwise.
+#
+# ignorecommand = /path/to/command <ip>
+ignorecommand =
+
+# "bantime" is the number of seconds that a host is banned.
+bantime  = {{ fail2ban.bantime|default('10m') }}
+
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
+findtime  = {{ fail2ban.findtime|default('10m') }}
+
+# "maxretry" is the number of failures before a host get banned.
+maxretry = {{ fail2ban.maxretry|default('5') }}
+
+# "backend" specifies the backend used to get files modification.
+# Available options are "pyinotify", "gamin", "polling", "systemd" and "auto".
+# This option can be overridden in each jail as well.
+#
+# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
+#              If pyinotify is not installed, Fail2ban will use auto.
+# gamin:     requires Gamin (a file alteration monitor) to be installed.
+#              If Gamin is not installed, Fail2ban will use auto.
+# polling:   uses a polling algorithm which does not require external libraries.
+# systemd:   uses systemd python library to access the systemd journal.
+#              Specifying "logpath" is not valid for this backend.
+#              See "journalmatch" in the jails associated filter config
+# auto:      will try to use the following backends, in order:
+#              pyinotify, gamin, polling.
+#
+# Note: if systemd backend is chosen as the default but you enable a jail
+#       for which logs are present only in its own log files, specify some other
+#       backend for that jail (e.g. polling) and provide empty value for
+#       journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200
+backend = auto
+
+# "usedns" specifies if jails should trust hostnames in logs,
+#   warn when DNS lookups are performed, or ignore all hostnames in logs
+#
+# yes:   if a hostname is encountered, a DNS lookup will be performed.
+# warn:  if a hostname is encountered, a DNS lookup will be performed,
+#        but it will be logged as a warning.
+# no:    if a hostname is encountered, will not be used for banning,
+#        but it will be logged as info.
+# raw:   use raw value (no hostname), allow use it for no-host filters/actions (example user)
+usedns = warn
+
+# "logencoding" specifies the encoding of the log files handled by the jail
+#   This is used to decode the lines from the log file.
+#   Typical examples:  "ascii", "utf-8"
+#
+#   auto:   will use the system locale setting
+logencoding = auto
+
+# "enabled" enables the jails.
+#  By default all jails are disabled, and it should stay this way.
+#  Enable only relevant to your setup jails in your .local or jail.d/*.conf
+#
+# true:  jail will be enabled and log files will get monitored for changes
+# false: jail is not enabled
+enabled = false
+
+
+# "mode" defines the mode of the filter (see corresponding filter implementation for more info).
+mode = normal
+
+# "filter" defines the filter to use by the jail.
+#  By default jails have names matching their filter name
+#
+filter = %(__name__)s[mode=%(mode)s]
+
+
+#
+# ACTIONS
+#
+
+# Some options used for actions
+
+# Destination email address used solely for the interpolations in
+# jail.{conf,local,d/*} configuration files.
+destemail = root@localhost
+
+# Sender email address used solely for some actions
+sender = root@<fq-hostname>
+
+# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the
+# mailing. Change mta configuration parameter to mail if you want to
+# revert to conventional 'mail'.
+mta = sendmail
+
+# Default protocol
+protocol = tcp
+
+# Specify chain where jumps would need to be added in ban-actions expecting parameter chain
+chain = <known/chain>
+
+# Ports to be banned
+# Usually should be overridden in a particular jail
+port = 0:65535
+
+# Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3
+fail2ban_agent = Fail2Ban/%(fail2ban_version)s
+
+#
+# Action shortcuts. To be used to define action parameter
+
+# Default banning action (e.g. iptables, iptables-new,
+# iptables-multiport, shorewall, etc) It is used to define
+# action_* variables. Can be overridden globally or per
+# section within jail.local file
+banaction = iptables-multiport
+banaction_allports = iptables-allports
+
+# The simplest action to take: ban only
+action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+# ban & send an e-mail with whois report to the destemail.
+action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+            %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+# ban & send an e-mail with whois report and relevant log lines
+# to the destemail.
+action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+             %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
+
+# See the IMPORTANT note in action.d/xarf-login-attack for when to use this action
+#
+# ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines
+# to the destemail.
+action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]
+
+# ban IP on CloudFlare & send an e-mail with whois report and relevant log lines
+# to the destemail.
+action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
+                %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
+
+# Report block via blocklist.de fail2ban reporting service API
+# 
+# See the IMPORTANT note in action.d/blocklist_de.conf for when to use this action.
+# Specify expected parameters in file action.d/blocklist_de.local or if the interpolation
+# `action_blocklist_de` used for the action, set value of `blocklist_de_apikey`
+# in your `jail.local` globally (section [DEFAULT]) or per specific jail section (resp. in 
+# corresponding jail.d/my-jail.local file).
+#
+action_blocklist_de  = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]
+
+# Report ban via badips.com, and use as blacklist
+#
+# See BadIPsAction docstring in config/action.d/badips.py for
+# documentation for this action.
+#
+# NOTE: This action relies on banaction being present on start and therefore
+# should be last action defined for a jail.
+#
+action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]
+#
+# Report ban via badips.com (uses action.d/badips.conf for reporting only)
+#
+action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]
+
+# Report ban via abuseipdb.com.
+#
+# See action.d/abuseipdb.conf for usage example and details.
+#
+action_abuseipdb = abuseipdb
+
+# Choose default action.  To change, just override value of 'action' with the
+# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
+# globally (section [DEFAULT]) or per specific section
+action = %(action_)s
+
+
+#
+# JAILS
+#
+
+#
+# SSH servers
+#
+
+[sshd]
+enabled = true
+port    = {{ sshd_config.Port|default('22') }}
+backend = systemd
+
+[dropbear]
+
+port    = {{ sshd_config.Port|default('22') }}
+logpath  = %(dropbear_log)s
+backend  = %(dropbear_backend)s
+
+
+[selinux-ssh]
+
+port    = {{ sshd_config.Port|default('22') }}
+logpath  = %(auditd_log)s
+
+
+#
+# HTTP servers
+#
+
+[apache-auth]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+
+
+[apache-badbots]
+# Ban hosts which agent identifies spammer robots crawling the web
+# for email addresses. The mail outputs are buffered.
+port     = http,https
+logpath  = %(apache_access_log)s
+bantime  = 48h
+maxretry = 1
+
+
+[apache-noscript]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+
+
+[apache-overflows]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-nohome]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-botsearch]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-fakegooglebot]
+
+port     = http,https
+logpath  = %(apache_access_log)s
+maxretry = 1
+ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot <ip>
+
+
+[apache-modsecurity]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-shellshock]
+
+port    = http,https
+logpath = %(apache_error_log)s
+maxretry = 1
+
+
+[openhab-auth]
+
+filter = openhab
+action = iptables-allports[name=NoAuthFailures]
+logpath = /opt/openhab/logs/request.log
+
+
+[nginx-http-auth]
+
+port    = http,https
+logpath = %(nginx_error_log)s
+
+# To use 'nginx-limit-req' jail you should have `ngx_http_limit_req_module` 
+# and define `limit_req` and `limit_req_zone` as described in nginx documentation
+# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
+# or for example see in 'config/filter.d/nginx-limit-req.conf'
+[nginx-limit-req]
+port    = http,https
+logpath = %(nginx_error_log)s
+
+[nginx-botsearch]
+
+port     = http,https
+logpath  = %(nginx_error_log)s
+maxretry = 2
+
+
+# Ban attackers that try to use PHP's URL-fopen() functionality
+# through GET/POST variables. - Experimental, with more than a year
+# of usage in production environments.
+
+[php-url-fopen]
+
+port    = http,https
+logpath = %(nginx_access_log)s
+          %(apache_access_log)s
+
+
+[suhosin]
+
+port    = http,https
+logpath = %(suhosin_log)s
+
+
+[lighttpd-auth]
+# Same as above for Apache's mod_auth
+# It catches wrong authentifications
+port    = http,https
+logpath = %(lighttpd_error_log)s
+
+
+#
+# Webmail and groupware servers
+#
+
+[roundcube-auth]
+
+port     = http,https
+logpath  = %(roundcube_errors_log)s
+# Use following line in your jail.local if roundcube logs to journal.
+#backend = %(syslog_backend)s
+
+
+[openwebmail]
+
+port     = http,https
+logpath  = /var/log/openwebmail.log
+
+
+[horde]
+
+port     = http,https
+logpath  = /var/log/horde/horde.log
+
+
+[groupoffice]
+
+port     = http,https
+logpath  = /home/groupoffice/log/info.log
+
+
+[sogo-auth]
+# Monitor SOGo groupware server
+# without proxy this would be:
+# port    = 20000
+port     = http,https
+logpath  = /var/log/sogo/sogo.log
+
+
+[tine20]
+
+logpath  = /var/log/tine20/tine20.log
+port     = http,https
+
+
+#
+# Web Applications
+#
+#
+
+[drupal-auth]
+
+port     = http,https
+logpath  = %(syslog_daemon)s
+backend  = %(syslog_backend)s
+
+[guacamole]
+
+port     = http,https
+logpath  = /var/log/tomcat*/catalina.out
+
+[monit]
+#Ban clients brute-forcing the monit gui login
+port = 2812
+logpath  = /var/log/monit
+
+
+[webmin-auth]
+
+port    = 10000
+logpath = %(syslog_authpriv)s
+backend = %(syslog_backend)s
+
+
+[froxlor-auth]
+
+port    = http,https
+logpath  = %(syslog_authpriv)s
+backend  = %(syslog_backend)s
+
+
+#
+# HTTP Proxy servers
+#
+#
+
+[squid]
+
+port     =  80,443,3128,8080
+logpath = /var/log/squid/access.log
+
+
+[3proxy]
+
+port    = 3128
+logpath = /var/log/3proxy.log
+
+
+#
+# FTP servers
+#
+
+
+[proftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(proftpd_log)s
+backend  = %(proftpd_backend)s
+
+
+[pure-ftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(pureftpd_log)s
+backend  = %(pureftpd_backend)s
+
+
+[gssftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(syslog_daemon)s
+backend  = %(syslog_backend)s
+
+
+[wuftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(wuftpd_log)s
+backend  = %(wuftpd_backend)s
+
+
+[vsftpd]
+# or overwrite it in jails.local to be
+# logpath = %(syslog_authpriv)s
+# if you want to rely on PAM failed login attempts
+# vsftpd's failregex should match both of those formats
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(vsftpd_log)s
+
+
+#
+# Mail servers
+#
+
+# ASSP SMTP Proxy Jail
+[assp]
+
+port     = smtp,465,submission
+logpath  = /root/path/to/assp/logs/maillog.txt
+
+
+[courier-smtp]
+
+port     = smtp,465,submission
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[postfix]
+# To use another modes set filter parameter "mode" in jail.local:
+mode    = more
+port    = smtp,465,submission
+logpath = %(postfix_log)s
+backend = %(postfix_backend)s
+
+
+[postfix-rbl]
+
+filter   = postfix[mode=rbl]
+port     = smtp,465,submission
+logpath  = %(postfix_log)s
+backend  = %(postfix_backend)s
+maxretry = 1
+
+
+[sendmail-auth]
+
+port    = submission,465,smtp
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[sendmail-reject]
+# To use more aggressive modes set filter parameter "mode" in jail.local:
+# normal (default), extra or aggressive
+# See "tests/files/logs/sendmail-reject" or "filter.d/sendmail-reject.conf" for usage example and details.
+#mode    = normal
+port     = smtp,465,submission
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[qmail-rbl]
+
+filter  = qmail
+port    = smtp,465,submission
+logpath = /service/qmail/log/main/current
+
+
+# dovecot defaults to logging to the mail syslog facility
+# but can be set by syslog_facility in the dovecot configuration.
+[dovecot]
+
+port    = pop3,pop3s,imap,imaps,submission,465,sieve
+logpath = %(dovecot_log)s
+backend = %(dovecot_backend)s
+
+
+[sieve]
+
+port   = smtp,465,submission
+logpath = %(dovecot_log)s
+backend = %(dovecot_backend)s
+
+
+[solid-pop3d]
+
+port    = pop3,pop3s
+logpath = %(solidpop3d_log)s
+
+
+[exim]
+# see filter.d/exim.conf for further modes supported from filter:
+#mode = normal
+port   = smtp,465,submission
+logpath = %(exim_main_log)s
+
+
+[exim-spam]
+
+port   = smtp,465,submission
+logpath = %(exim_main_log)s
+
+
+[kerio]
+
+port    = imap,smtp,imaps,465
+logpath = /opt/kerio/mailserver/store/logs/security.log
+
+
+#
+# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
+# all relevant ports get banned
+#
+
+[courier-auth]
+
+port     = smtp,465,submission,imap,imaps,pop3,pop3s
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[postfix-sasl]
+
+filter   = postfix[mode=auth]
+port     = smtp,465,submission,imap,imaps,pop3,pop3s
+# You might consider monitoring /var/log/mail.warn instead if you are
+# running postfix since it would provide the same log lines at the
+# "warn" level but overall at the smaller filesize.
+logpath  = %(postfix_log)s
+backend  = %(postfix_backend)s
+
+
+[perdition]
+
+port   = imap,imaps,pop3,pop3s
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[squirrelmail]
+
+port = smtp,465,submission,imap,imap2,imaps,pop3,pop3s,http,https,socks
+logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log
+
+
+[cyrus-imap]
+
+port   = imap,imaps
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[uwimap-auth]
+
+port   = imap,imaps
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+#
+#
+# DNS servers
+#
+
+
+# !!! WARNING !!!
+#   Since UDP is connection-less protocol, spoofing of IP and imitation
+#   of illegal actions is way too simple.  Thus enabling of this filter
+#   might provide an easy way for implementing a DoS against a chosen
+#   victim. See
+#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
+#   Please DO NOT USE this jail unless you know what you are doing.
+#
+# IMPORTANT: see filter.d/named-refused for instructions to enable logging
+# This jail blocks UDP traffic for DNS requests.
+# [named-refused-udp]
+#
+# filter   = named-refused
+# port     = domain,953
+# protocol = udp
+# logpath  = /var/log/named/security.log
+
+# IMPORTANT: see filter.d/named-refused for instructions to enable logging
+# This jail blocks TCP traffic for DNS requests.
+
+[named-refused]
+
+port     = domain,953
+logpath  = /var/log/named/security.log
+
+
+[nsd]
+
+port     = 53
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+logpath = /var/log/nsd.log
+
+
+#
+# Miscellaneous
+#
+
+[asterisk]
+
+port     = 5060,5061
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+           %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
+logpath  = /var/log/asterisk/messages
+maxretry = 10
+
+
+[freeswitch]
+
+port     = 5060,5061
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+           %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
+logpath  = /var/log/freeswitch.log
+maxretry = 10
+
+
+# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or
+# equivalent section:
+# log-warning = 2
+#
+# for syslog (daemon facility)
+# [mysqld_safe]
+# syslog
+#
+# for own logfile
+# [mysqld]
+# log-error=/var/log/mysqld.log
+[mysqld-auth]
+
+port     = 3306
+logpath  = %(mysql_log)s
+backend  = %(mysql_backend)s
+
+
+# Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf')
+[mongodb-auth]
+# change port when running with "--shardsvr" or "--configsvr" runtime operation
+port     = 27017
+logpath  = /var/log/mongodb/mongodb.log
+
+
+# Jail for more extended banning of persistent abusers
+# !!! WARNINGS !!!
+# 1. Make sure that your loglevel specified in fail2ban.conf/.local
+#    is not at DEBUG level -- which might then cause fail2ban to fall into
+#    an infinite loop constantly feeding itself with non-informative lines
+# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
+#    to maintain entries for failed logins for sufficient amount of time
+[recidive]
+
+logpath  = /var/log/fail2ban.log
+banaction = %(banaction_allports)s
+bantime  = 1w
+findtime = 1d
+
+
+# Generic filter for PAM. Has to be used with action which bans all
+# ports such as iptables-allports, shorewall
+
+[pam-generic]
+# pam-generic filter can be customized to monitor specific subset of 'tty's
+banaction = %(banaction_allports)s
+logpath  = %(syslog_authpriv)s
+backend  = %(syslog_backend)s
+
+
+[xinetd-fail]
+
+banaction = iptables-multiport-log
+logpath   = %(syslog_daemon)s
+backend   = %(syslog_backend)s
+maxretry  = 2
+
+
+# stunnel - need to set port for this
+[stunnel]
+
+logpath = /var/log/stunnel4/stunnel.log
+
+
+[ejabberd-auth]
+
+port    = 5222
+logpath = /var/log/ejabberd/ejabberd.log
+
+
+[counter-strike]
+
+logpath = /opt/cstrike/logs/L[0-9]*.log
+# Firewall: http://www.cstrike-planet.com/faq/6
+tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039
+udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015
+action  = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+
+# consider low maxretry and a long bantime
+# nobody except your own Nagios server should ever probe nrpe
+[nagios]
+
+logpath  = %(syslog_daemon)s     ; nrpe.cfg may define a different log_facility
+backend  = %(syslog_backend)s
+maxretry = 1
+
+
+[oracleims]
+# see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above
+logpath = /opt/sun/comms/messaging64/log/mail.log_current
+banaction = %(banaction_allports)s
+
+[directadmin]
+logpath = /var/log/directadmin/login.log
+port = 2222
+
+[portsentry]
+logpath  = /var/lib/portsentry/portsentry.history
+maxretry = 1
+
+[pass2allow-ftp]
+# this pass2allow example allows FTP traffic after successful HTTP authentication
+port         = ftp,ftp-data,ftps,ftps-data
+# knocking_url variable must be overridden to some secret value in jail.local
+knocking_url = /knocking/
+filter       = apache-pass[knocking_url="%(knocking_url)s"]
+# access log of the website with HTTP auth
+logpath      = %(apache_access_log)s
+blocktype    = RETURN
+returntype   = DROP
+action       = %(action_)s[blocktype=%(blocktype)s, returntype=%(returntype)s]
+bantime      = 1h
+maxretry     = 1
+findtime     = 1
+
+
+[murmur]
+# AKA mumble-server
+port     = 64738
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol=tcp, chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol=udp, chain="%(chain)s", actname=%(banaction)s-udp]
+logpath  = /var/log/mumble-server/mumble-server.log
+
+
+[screensharingd]
+# For Mac OS Screen Sharing Service (VNC)
+logpath  = /var/log/system.log
+logencoding = utf-8
+
+[haproxy-http-auth]
+# HAProxy by default doesn't log to file you'll need to set it up to forward
+# logs to a syslog server which would then write them to disk.
+# See "haproxy-http-auth" filter for a brief cautionary note when setting
+# maxretry and findtime.
+logpath  = /var/log/haproxy.log
+
+[slapd]
+port    = ldap,ldaps
+logpath = /var/log/slapd.log
+
+[domino-smtp]
+port    = smtp,ssmtp
+logpath = /home/domino01/data/IBM_TECHNICAL_SUPPORT/console.log
+
+[phpmyadmin-syslog]
+port    = http,https
+logpath = %(syslog_authpriv)s
+backend = %(syslog_backend)s
+
+
+[zoneminder]
+# Zoneminder HTTP/HTTPS web interface auth
+# Logs auth failures to apache2 error log
+port    = http,https
+logpath = %(apache_error_log)s
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hardening.rules.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hardening.rules.j2
@@ -0,0 +1,354 @@
+# {{ ansible_managed }}
+# https://github.com/konstruktoid/ansible-role-hardening/blob/master/templates/etc/audit/rules.d/hardening.rules.j2
+# https://github.com/konstruktoid/Ansible/blob/master/roles/docker/templates/audit.rules.j2
+# https://github.com/gds-operations/puppet-auditd/tree/master/templates
+
+# Remove any existing rules
+-D
+
+# Buffer Size
+-b 8192
+
+# Ignore errors
+-i
+
+# Failure Mode
+-f {{ auditd_mode|int }}
+
+# File and directory access
+-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S open -F dir=/bin -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/etc -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/home -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/root -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/sbin -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/srv -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/tmp -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/usr/bin -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/usr/sbin -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F dir=/var -F success=0 -k access
+-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/root -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/tmp -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k access
+-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access
+-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access
+
+-a always,exit -F arch=b32 -C euid!=uid -F euid=0 -Fauid>=1000 -F auid!=-1 -S execve -k actions
+-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -C euid!=uid -F euid=0 -Fauid>=1000 -F auid!=-1 -S execve -k actions
+-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k actions
+-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=-1 -k actions
+
+# su and sudo
+-w /bin/su -p x -k actions
+-w /etc/sudoers -p wa -k actions
+-w /etc/sudoers.d -p wa -k actions
+-w /usr/bin/sudo -p x -k actions
+
+-a always,exit -S all -F dir=/home/ -F uid=0 -C auid!=obj_uid -k admin-user-home
+
+# Apparmor configuration and tools
+-w /etc/apparmor -p wa -k apparmor
+-w /etc/apparmor.d -p wa -k apparmor
+-w /sbin/apparmor_parser -p x -k apparmor-tools
+-w /usr/sbin/aa-complain -p x -k apparmor-tools
+-w /usr/sbin/aa-disable -p x -k apparmor-tools
+-w /usr/sbin/aa-enforce -p x -k apparmor-tools
+
+# Auditd configuration
+-w /etc/audisp -p wa -k audispconfig
+-w /etc/audit -p wa -k auditconfig
+-w /etc/libaudit.conf -p wa -k auditconfig
+-w /var/log/audit -p rwxa -k auditlog
+-w /sbin/auditctl -p x -k audittools
+-w /sbin/auditd -p x -k audittools
+
+# Cron
+-w /etc/cron.allow -p wa -k cron
+-w /etc/cron.d -p wa -k cron
+-w /etc/cron.daily -p wa -k cron
+-w /etc/cron.deny -p wa -k cron
+-w /etc/cron.hourly -p wa -k cron
+-w /etc/cron.monthly -p wa -k cron
+-w /etc/cron.weekly -p wa -k cron
+-w /etc/crontab -p wa -k cron
+-w /var/spool/cron/crontabs -p rwxa -k cron
+
+-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete
+-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete
+
+# Docker configuration and tools
+-a exit,always -F path=/var/lib/docker -F perm=war -k docker
+-w /etc/default/docker -p rwxa -k docker
+-w /etc/docker -p rwxa -k docker
+-w /etc/sysconfig/docker -p rwxa -k docker
+-w /etc/sysconfig/docker-network -p rwxa -k docker
+-w /etc/sysconfig/docker-registry -p rwxa -k docker
+-w /etc/sysconfig/docker-storage -p rwxa -k docker
+-w /etc/systemd/system/docker-registry.service -p rwxa -k docker
+-w /etc/systemd/system/docker.service -p rwxa -k docker
+-w /lib/systemd/system/docker-registry.service -p rwxa -k docker
+-w /lib/systemd/system/docker.service -p rwxa -k docker
+-w /lib/systemd/system/docker.socket -p rwxa -k docker
+-w /usr/bin/containerd -p rwxa -k docker
+-w /usr/bin/containerd-shim -p rwxa -k docker
+-w /usr/bin/containerd-shim-runc-v1 -p rwxa -k docker
+-w /usr/bin/containerd-shim-runc-v2 -p rwxa -k docker
+-w /usr/bin/ctr -p rwxa -k docker
+-w /usr/bin/docker -p rwxa -k docker
+-w /usr/bin/docker-containerd -p rwxa -k docker
+-w /usr/bin/docker-containerd-ctr -p rwxa -k docker
+-w /usr/bin/docker-containerd-shim -p rwxa -k docker
+-w /usr/bin/docker-init -p rwxa -k docker
+-w /usr/bin/docker-proxy -p rwxa -k docker
+-w /usr/bin/docker-runc -p rwxa -k docker
+-w /usr/bin/dockerd -p rwxa -k docker
+-w /usr/bin/dockerd-ce -p rwxa -k docker
+-w /usr/bin/rootlesskit -p rwxa -k docker
+-w /usr/bin/rootlesskit-docker-proxy -p rwxa -k docker
+-w /usr/bin/runc -p rwxa -k docker
+-w /usr/lib/systemd/system/docker-registry.service -p rwxa -k docker
+-w /usr/lib/systemd/system/docker.service -p rwxa -k docker
+-w /usr/sbin/runc -p rwxa -k docker
+-w /var/run/docker.sock -p rwxa -k docker
+
+# Group modifications
+-w /etc/group -p wa -k group-modification
+-w /etc/gshadow -p wa -k group-modification
+-w /etc/passwd -p wa -k group-modification
+-w /etc/security/opasswd -p wa -k group-modification
+-w /etc/shadow -p wa -k group-modification
+-w /usr/sbin/addgroup -p x -k group-modification
+-w /usr/sbin/groupadd -p x -k group-modification
+-w /usr/sbin/groupmod -p x -k group-modification
+
+# Startup scripts
+-w /etc/init -p wa -k init
+-w /etc/init.d -p wa -k init
+-w /etc/inittab -p wa -k init
+
+# Library lookup paths
+-w /etc/ld.so.conf -p wa -k libpath
+-w /etc/ld.so.conf.d/ -p wa -k libpath
+
+# Local time
+-w /etc/localtime -p wa -k localtime
+
+# Login monitoring
+-w /etc/login.defs -p wa -k login
+-w /etc/securetty -p wa -k login
+-w /var/log/faillog -p wa -k login
+-w /var/log/lastlog -p wa -k login
+-w /var/log/tallylog -p wa -k login
+-w /var/run/faillock -p wa -k login
+
+# SELinux configuration
+-w /etc/selinux -p wa -k mac-policy
+
+# Postfix configuration
+-w /etc/aliases -p wa -k mail
+-w /etc/postfix -p wa -k mail
+
+# Kernel module configuration and tools
+-w /etc/modprobe.conf -p wa -k modprobe
+-w /etc/modprobe.d -p wa -k modprobe
+-w /etc/modules -p wa -k modprobe
+-a always,exit -F arch=b32 -S finit_module -k modules
+-a always,exit -F arch=b32 -S init_module -k modules
+-a always,exit -F arch=b64 -S finit_module -k modules
+-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
+-w /bin/kmod -p x -k modules
+-w /sbin/insmod -p x -k modules
+-w /sbin/modprobe -p x -k modules
+-w /sbin/rmmod -p x -k modules
+-w /usr/bin/kmod -p x -k modules
+-w /usr/sbin/insmod -p x -k modules
+-w /usr/sbin/modprobe -p x -k modules
+-w /usr/sbin/rmmod -p x -k modules
+
+#
+-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=-1 -k mounts
+-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=-1 -k mounts
+
+# Network configuration
+-w /etc/hosts -p wa -k network-config
+-w /etc/issue -p wa -k network-config
+-w /etc/issue.net -p wa -k network-config
+-w /etc/netplan -p wa -k network-config
+-w /etc/network -p wa -k network-config
+-w /etc/sysconfig/network -p wa -k network-config
+
+# PAM configuration
+-w /etc/pam.d -p wa -k pam
+-w /etc/security/limits.conf -p wa -k pam
+-w /etc/security/namespace.conf -p wa -k pam
+-w /etc/security/namespace.init -p wa -k pam
+-w /etc/security/pam_env.conf -p wa -k pam
+
+# Password modifications
+-w /usr/bin/passwd -p x -k passwd-modification
+
+# Power state
+-w /sbin/halt -p x -k power
+-w /sbin/poweroff -p x -k power
+-w /sbin/reboot -p x -k power
+-w /sbin/shutdown -p x -k power
+
+# Use of privileged commands
+-a always,exit -F path=/bin/fusermount -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/bin/ntfs-3g -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/bin/ping -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/bin/ping6 -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/sbin/pam_extrausers_chkpwd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/bsd-write -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/cgclassify -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/cgexec -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/dotlockfile -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/expiry -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/mlocate -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/screen -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/traceroute6.iputils -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/userhelper -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/lib/dbus-1.0/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/lib/eject/dmcrypt-get-device -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/lib/policykit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/lib/snapd/snap-confine -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/lib/x86_64-linux-gnu/utempter/utempter -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/fping -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/fping6 -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/mount.cifs -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/pam_extrausers_chkpwd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/pam-tmpdir-helper -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/usernetct -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+-a always,exit -F path=/usr/sbin/vlock-main -F perm=x -F auid>=1000 -F auid!=-1 -k privileged
+
+#
+-w /var/log/btmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+-w /var/run/utmp -p wa -k session
+
+# Special files
+-a always,exit -F arch=b32 -S mknod,mknodat -k specialfiles
+-a always,exit -F arch=b64 -S mknod,mknodat -k specialfiles
+
+# sshd configuration
+-w /etc/ssh/sshd_config -p rwxa -k sshd
+-w /etc/ssh/sshd_config.d/ -p rwxa -k sshd
+
+# Kernel modification
+-w /etc/sysctl.conf -p wa -k sysctl
+
+# Hostname changes
+-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
+-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
+
+# systemd configuration and tools
+-w /etc/systemd -p wa -k systemd
+-w /lib/systemd -p wa -k systemd
+-w /bin/journalctl -p x -k systemd-tools
+-w /bin/systemctl -p x -k systemd-tools
+
+# Time modification
+-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
+-a always,exit -F arch=b32 -S clock_settime -k time-change
+-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
+-a always,exit -F arch=b64 -S clock_settime -k time-change
+-w /etc/localtime -p wa -k time-change
+-w /etc/timezone -p wa -k time-changezone
+
+# /tmp directories
+-w /tmp -p wxa -k tmp
+-w /var/tmp -p wxa -k tmp
+
+# User modification
+-w /usr/sbin/adduser -p x -k user-modification
+-w /usr/sbin/useradd -p x -k user-modification
+-w /usr/sbin/usermod -p x -k user-modification
+
+-e 2
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hosts.allow.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hosts.allow.j2
@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+
+sshd : ALL : ALLOW
+ALL: LOCAL, 127.0.0.1
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hosts.deny.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hosts.deny.j2
@@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+
+ALL: ALL
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hosts.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/hosts.j2
@@ -0,0 +1,7 @@
+127.0.0.1 localhost localhost.localdomain
+127.0.1.1	{{ inventory_hostname }}
+
+# The following lines are desirable for IPv6 capable hosts
+::1 localhost6 localhost6.localdomain
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/iptables.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/iptables.j2
@@ -0,0 +1,64 @@
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
+COMMIT
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:CHECK_INPUT - [0:0]
+:CHECK_OUTPUT - [0:0]
+-A INPUT -j CHECK_INPUT
+-A INPUT -j DROP
+-A OUTPUT -j CHECK_OUTPUT
+-A OUTPUT -j DROP
+-A CHECK_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+{% if iptables.network_adapter_access is defined %}
+{% for net in iptables.network_adapter_access %}
+-A CHECK_INPUT -i {{ net }} -j ACCEPT
+{% endfor %}
+{% endif %}
+-A CHECK_INPUT -p tcp -m tcp --dport {{ sshd_config.Port|default('22') }} -j ACCEPT
+{% if iptables.tcp_port_access is defined %}
+{% for tcp in iptables.tcp_port_access %}
+-A CHECK_INPUT -p tcp -m tcp --dport {{ tcp }} -j ACCEPT
+{% endfor %}
+{% endif %}
+{% if iptables.udp_port_access is defined %}
+{% for udp in iptables.udp_port_access %}
+-A CHECK_INPUT -p udp -m udp --dport {{ udp }} -j ACCEPT
+{% endfor %}
+{% endif %}
+{% if iptables.trusted_IP is defined %}
+{% for ip in iptables.trusted_IP %}
+-A CHECK_INPUT -s {{ ip }} -j ACCEPT -m comment --comment "The Trusted Server Ip"
+{% endfor %}
+{% endif %}
+{% if iptables.trusted_Range is defined %}
+{% for range in iptables.trusted_Range %}
+-A CHECK_INPUT -s {{ range }} -j ACCEPT -m comment --comment "The Trusted Server Range"
+{% endfor %}
+{% endif %}
+-A CHECK_OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A CHECK_OUTPUT -j ACCEPT
+COMMIT
+
+
+
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/journald.conf.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/journald.conf.j2
@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+
+[Journal]
+Storage=persistent
+ForwardToSyslog=yes
+Compress=yes
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/limits.conf.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/limits.conf.j2
@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+
+* hard maxlogins 10
+* hard core 0
+* soft nproc {{ limit_nproc_soft }}
+* hard nproc {{ limit_nproc_hard }}
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/logrotate.conf.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/logrotate.conf.j2
@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+# CCE-80195-1
+
+daily
+{% if ansible_distribution == 'Ubuntu' %}
+su root syslog
+{% endif %}
+rotate 7
+create
+dateext
+compress
+
+compresscmd /usr/bin/xz
+uncompresscmd /usr/bin/unxz
+compressext .xz
+
+include /etc/logrotate.d
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/resolv.conf.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/resolv.conf.j2
@@ -0,0 +1,2 @@
+nameserver 8.8.8.8
+nameserver 4.2.2.4
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/resolved.conf.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/resolved.conf.j2
@@ -0,0 +1,7 @@
+# {{ ansible_managed }}
+
+[Resolve]
+DNS={{ dns }}
+FallbackDNS={{ fallback_dns }}
+DNSSEC={{ dnssec }}
+DNSOverTLS={{ dns_over_tls }}
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/sshd_config.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/sshd_config.j2
@@ -0,0 +1,115 @@
+Include /etc/ssh/sshd_config.d/*.conf
+
+Port {{ sshd_config.Port|default('22') }}
+#AddressFamily any
+ListenAddress {{ sshd_config.ListenAddress|default('0.0.0.0') }}
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+LogLevel VERBOSE
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin {{ sshd_config.PermitRootLogin|default('without-password') }}
+#StrictModes yes
+MaxAuthTries 3
+MaxSessions 2
+
+#PubkeyAuthentication yes
+
+# Expect .ssh/authorized_keys2 to be disregarded by default in future.
+#AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2
+
+#AuthorizedPrincipalsFile none
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication {{ sshd_config.PasswordAuthentication|default('yes') }}
+#PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+
+AllowAgentForwarding no
+AllowTcpForwarding no
+#GatewayPorts no
+X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+PrintMotd no
+#PrintLastLog yes
+TCPKeepAlive no
+#PermitUserEnvironment no
+Compression no
+#ClientAliveInterval 0
+ClientAliveCountMax 2
+#UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+Banner /etc/issue
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem sftp	/usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server
+
+{% if sshd_config.AllowUsers is defined %}
+AllowUsers {{ sshd_config.AllowUsers }}
+{% endif %}
+{% if sshd_config.AllowGroups is defined %}
+AllowGroups {{ sshd_config.AllowGroups }}
+{% endif %}
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/timout.j2
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/templates/timout.j2
@@ -0,0 +1,5 @@
+#!/bin/bash
+### 300 seconds == 5 minutes ##
+TMOUT={{ timeout_time }}
+readonly TMOUT
+export TMOUT