added the a preparing ansible playbooks for automating new servers

2026-08-23 22:11:09 +03:30
parent e8422c0006
commit aedfdbddb7
73 changed files with 2971 additions and 44 deletions
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/auditd.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/auditd.yml
@@ -0,0 +1,116 @@
+---
+- name: set Debian audit grub cmdline
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX {{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"'
+    dest: /etc/default/grub.d/99-hardening-audit.cfg
+    state: present
+    create: 'yes'
+    mode: 0755
+    owner: root
+    group: root
+
+- name: set audit action_mail_acct
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^action_mail_acct ="
+    line: "action_mail_acct = {{ auditd_action_mail_acct }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit admin_space_left_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^admin_space_left_action = "
+    line: "admin_space_left_action = {{ auditd_admin_space_left_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit disk_error_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^disk_error_action ="
+    line: "disk_error_action = {{ auditd_disk_error_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit disk_full_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^disk_full_action ="
+    line: "disk_full_action = {{ auditd_disk_full_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit max_log_file
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^max_log_file ="
+    line: "max_log_file = {{ auditd_max_log_file }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit max_log_file_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^max_log_file_action ="
+    line: "max_log_file_action = {{ auditd_max_log_file_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit num_logs
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^num_logs ="
+    line: "num_logs = {{ auditd_num_logs }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit space_left
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^space_left ="
+    line: "space_left = {{ auditd_space_left }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: set audit space_left_action
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: "^space_left_action ="
+    line: "space_left_action = {{ auditd_space_left_action }}"
+    dest: /etc/audit/auditd.conf
+    mode: 0640
+    state: present
+    create: 'no'
+
+- name: audit.rules
+  become: 'yes'
+  ansible.builtin.template:
+    src: hardening.rules.j2
+    dest: /etc/audit/rules.d/hardening.rules
+    backup: 'yes'
+    mode: 0600
+    owner: root
+    group: root
+  when: auditd_apply_audit_rules|bool
+  notify:
+    - generate auditd
+    - restart auditd
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/fstab.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/fstab.yml
@@ -0,0 +1,18 @@
+---
+- name: remove /tmp from fstab
+  become: 'yes'
+  mount:
+    path: /tmp
+    state: absent
+  tags:
+    - fstab
+
+- name: remove floppy from fstab
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    path: /etc/fstab
+    state: absent
+    regexp: '^(.*)floppy(.*)$'
+  tags:
+    - fstab
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hardening.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hardening.yaml
@@ -0,0 +1,55 @@
+---
+- name: Stop and Disable ufw service if started
+  ansible.builtin.service:
+    name: ufw
+    state: stopped
+    enabled: no
+  ignore_errors: yes   # not installed on this box (confirmed: ufw: command not found)
+
+- name: Stop and Disable postfix service if started
+  ansible.builtin.service:
+    name: postfix
+    state: stopped
+    enabled: no
+  ignore_errors: yes
+
+- name: Make timout configuration file.
+  template:
+    src: timout.j2
+    dest: /etc/profile.d/timout-settings.sh
+
+- name: Set timezone to Asia/Tehran
+  community.general.timezone:
+    name: Asia/Tehran
+  notify: Restart ntp
+
+- name: Copy ssh banner file.
+  copy:
+    src: ssh_banner
+    dest: /etc/issue
+
+- name: Make sshd configuration file.
+  template:
+    src: sshd_config.j2
+    dest: /etc/ssh/sshd_config
+  notify: Restart ssh
+
+
+
+- name: Make iptables configuration file.
+  template:
+    src: iptables.j2
+    dest: /etc/iptables/rules.v4
+
+- name: restore iptables state from a file
+  community.general.iptables_state:
+    state: restored
+    path: /etc/iptables/rules.v4
+    noflush: true
+  notify: Restart iptables
+
+- name: Make fail2ban configuration file.
+  template:
+    src: fial2ban.j2
+    dest: /etc/fail2ban/jail.local
+  notify: Restart fail2ban
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hosts.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/hosts.yml
@@ -0,0 +1,21 @@
+---
+- name: hosts.allow
+  become: 'yes'
+  ansible.builtin.template:
+    src: hosts.allow.j2
+    dest: /etc/hosts.allow
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+
+- name: hosts.deny
+  become: 'yes'
+  ansible.builtin.template:
+    src: hosts.deny.j2
+    dest: /etc/hosts.deny
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/journalconf.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/journalconf.yml
@@ -0,0 +1,68 @@
+---
+- name: systemd journald.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: journald.conf.j2
+    dest: /etc/systemd/journald.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+  notify:
+    - reload systemd
+
+- name: logrotate.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: logrotate.conf.j2
+    dest: /etc/logrotate.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+
+- name: cron.daily logrotate
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    line: "/usr/sbin/logrotate /etc/logrotate.conf"
+    dest: /etc/cron.daily/logrotate
+    mode: 0750
+    state: present
+    create: 'yes'
+
+- name: stat rsyslog.conf
+  become: 'yes'
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: rsyslogconf
+
+- name: get rsyslog.conf FileCreateMode
+  become: 'yes'
+  environment:
+    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  ansible.builtin.shell: grep "^$FileCreateMode" /etc/rsyslog.conf
+  register: rsyslog_filecreatemode
+  changed_when: false
+  when: rsyslogconf.stat.exists
+
+- name: set rsyslog.conf FileCreateMode
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: '^\$FileCreateMode'
+    line: '$FileCreateMode 0600'
+    dest: /etc/rsyslog.conf
+    mode: 0640
+    state: present
+    create: 'no'
+  when: rsyslogconf.stat.exists and rsyslog_filecreatemode.stdout.find('FileCreateMode') != -1
+
+- name: set rsyslog.d FileCreateMode
+  become: 'yes'
+  ansible.builtin.lineinfile:
+    regexp: '^\$FileCreateMode'
+    line: '$FileCreateMode 0600'
+    dest: /etc/rsyslog.d/99-filecreatemode.conf
+    mode: 0644
+    state: present
+    create: 'yes'
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/limits.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/limits.yml
@@ -0,0 +1,21 @@
+---
+- name: limits.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: limits.conf.j2
+    dest: /etc/security/limits.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+
+- name: coredump.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: coredump.conf.j2
+    dest: /etc/systemd/coredump.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+...
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/lynis.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/lynis.yaml
@@ -0,0 +1,7 @@
+---
+- name: Install lynis from Debian repo
+  apt:
+    name: lynis
+    state: present
+    update_cache: yes
+  tags: lynis
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/main.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/main.yaml
@@ -0,0 +1,40 @@
+---
+- name: install package
+  import_tasks: packages.yaml
+  tags: install_packages
+
+- name: change limit.conf
+  import_tasks: limits.yml
+  tags: tuning
+
+- name: configure sshd, iptabels and ...
+  import_tasks: hardening.yaml
+  tags: hardening, firewall
+
+- name: host file configure
+  import_tasks: hosts.yml
+  tags: hardening
+
+- name: audit log configure
+  import_tasks: auditd.yml
+  tags: hardening
+
+- name: fstab config
+  import_tasks: fstab.yml
+  tags: hardening
+
+- name: change resolved.conf
+  import_tasks: resolvedconf.yml
+  tags: hardening
+
+- name: change journal.conf
+  import_tasks: journalconf.yml
+  tags: hardening
+
+- name: change sysctl.conf
+  import_tasks: tuning.yaml
+  tags: tuning
+
+- name: download and config lynis scripts
+  import_tasks: lynis.yaml
+  tags: audit
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/packages.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/packages.yaml
@@ -0,0 +1,33 @@
+---
+- name: Update apt cache (no full-system/kernel upgrade — avoids grub-pc + shared-folder breakage)
+  apt:
+    update_cache: yes
+    cache_valid_time: 86400
+- name: Stop systemd-timesyncd (conflicts with the ntp package below)
+  ansible.builtin.systemd:
+    name: systemd-timesyncd
+    state: stopped
+    enabled: no
+  ignore_errors: yes
+
+- name: Remove systemd-timesyncd so ntp can install cleanly
+  apt:
+    name: systemd-timesyncd
+    state: absent
+  ignore_errors: yes
+
+- name: Install basic tools
+  apt:
+    name: "{{ packages }}"
+    state: present
+    force_apt_get: yes
+    update_cache: yes
+
+- name: Set hostname
+  hostname:
+    name: '{{ inventory_hostname }}'
+
+- name: Fix /etc/hosts
+  template:
+    src: "hosts.j2"
+    dest: "/etc/hosts"
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/resolvedconf.yml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/resolvedconf.yml
@@ -0,0 +1,22 @@
+---
+- name: resolved.conf
+  become: 'yes'
+  ansible.builtin.template:
+    src: resolved.conf.j2
+    dest: /etc/systemd/resolved.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
+  notify:
+    - reload systemd
+
+- name: resolv.conf
+  become: 'yes'
+  template:
+    src: resolv.conf.j2
+    dest: /etc/resolv.conf
+    backup: 'yes'
+    mode: 0644
+    owner: root
+    group: root
--- a/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/tuning.yaml
+++ b/ansible/preparing-playbook/reza-ansible/roles/preparing_server/tasks/tuning.yaml
@@ -0,0 +1,15 @@
+---
+- name: Add the br_netfilter module
+  community.general.modprobe:
+    name: br_netfilter
+    state: present
+
+- name: Change various sysctl-settings
+  sysctl:
+    name: "{{ item.key }}"
+    state: present
+    value: "{{ item.value }}"
+    sysctl_file: /etc/sysctl.d/MeCan.conf
+    reload: yes
+    ignoreerrors: yes
+  with_dict: '{{ sysctl_config }}'