107 lines
2.3 KiB
YAML
107 lines
2.3 KiB
YAML
# basic package list for installation
|
|
packages:
|
|
- sysstat
|
|
- wget
|
|
- git
|
|
- vim
|
|
- nano
|
|
- bash-completion
|
|
- curl
|
|
- htop
|
|
- iftop
|
|
- jq
|
|
- ncdu
|
|
- unzip
|
|
- net-tools
|
|
- dnsutils
|
|
- atop
|
|
- sudo
|
|
- ntp
|
|
- fail2ban
|
|
- software-properties-common
|
|
- apache2-utils
|
|
- tcpdump
|
|
- telnet
|
|
- axel
|
|
- iptables-persistent
|
|
- auditd
|
|
- libpwquality-common
|
|
- cracklib-runtime
|
|
|
|
# sshd configuration
|
|
sshd_config:
|
|
Port: "{{ ansible_port }}"
|
|
ListenAddress: 0.0.0.0
|
|
PermitRootLogin: without-password
|
|
PasswordAuthentication: "yes"
|
|
AllowUsers: root
|
|
AllowGroups: root
|
|
|
|
# iptables configuration
|
|
iptables:
|
|
network_adapter_access:
|
|
- lo
|
|
tcp_port_access:
|
|
- 80
|
|
- 443
|
|
#udp_port_access:
|
|
# trusted IPs/ranges come from vault.yaml (see vault.yaml.example)
|
|
trusted_IP: "{{ vault_trusted_ips }}"
|
|
trusted_Range: "{{ vault_trusted_ranges }}"
|
|
|
|
# fail2ban configuration
|
|
fail2ban:
|
|
bantime: 10m
|
|
findtime: 10m
|
|
maxretry: 5
|
|
|
|
# setion timeout setting (seconds)
|
|
timeout_time: 600
|
|
|
|
# auditd vars
|
|
auditd_apply_audit_rules: 'yes'
|
|
auditd_action_mail_acct: root
|
|
auditd_admin_space_left_action: suspend
|
|
auditd_disk_error_action: suspend
|
|
auditd_disk_full_action: suspend
|
|
auditd_max_log_file: 8
|
|
auditd_max_log_file_action: keep_logs
|
|
auditd_mode: 1
|
|
auditd_num_logs: 5
|
|
auditd_space_left: 75
|
|
auditd_space_left_action: email
|
|
grub_audit_backlog_cmdline: audit_backlog_limit=8192
|
|
grub_audit_cmdline: audit=1
|
|
|
|
# lynis variables
|
|
lynis_version: '3.1.7'
|
|
lynis_name: 'lynis-{{ lynis_version }}'
|
|
lynis_tarball_url: 'https://downloads.cisofy.com/lynis/{{ lynis_name }}.tar.gz'
|
|
lynis_tarball_unpackdest: '/opt'
|
|
lynis_tarball_unpackdest_dir: '{{ lynis_tarball_unpackdest }}/lynis'
|
|
lynis_tarball_dest: '{{ lynis_tarball_unpackdest_dir }}/{{ lynis_name }}.tar.gz'
|
|
|
|
# dns variables
|
|
dns: 8.8.8.8 1.1.1.1
|
|
fallback_dns: 9.9.9.9 4.2.2.4
|
|
dnssec: allow-downgrade
|
|
dns_over_tls: opportunistic
|
|
|
|
# Limit.conf variables
|
|
limit_nofile_hard: 1024
|
|
limit_nofile_soft: 512
|
|
limit_nproc_hard: 1024
|
|
limit_nproc_soft: 512
|
|
|
|
# sysctll configuration variables
|
|
sysctl_config:
|
|
net.ipv4.ip_forward: 1
|
|
net.ipv4.conf.all.forwarding: 1
|
|
net.ipv6.conf.all.forwarding: 1
|
|
vm.max_map_count: 262144
|
|
fs.file-max: 1500000
|
|
net.ipv4.tcp_tw_reuse: 1
|
|
net.netfilter.nf_conntrack_tcp_timeout_established: 900
|
|
net.netfilter.nf_conntrack_tcp_timeout_close_wait: 10
|
|
net.netfilter.nf_conntrack_tcp_timeout_syn_recv: 30
|