77 lines
2.3 KiB
YAML
77 lines
2.3 KiB
YAML
# Alliance Boréale - Rôle Common - Security Hardening
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
- name: "🔒 Disable unnecessary services"
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
state: stopped
|
|
enabled: false
|
|
loop:
|
|
- bluetooth
|
|
- cups
|
|
failed_when: false
|
|
|
|
- name: "🔒 Configure sysctl security parameters"
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
state: present
|
|
reload: true
|
|
loop:
|
|
- { key: 'net.ipv4.conf.all.rp_filter', value: '1' }
|
|
- { key: 'net.ipv4.conf.default.rp_filter', value: '1' }
|
|
- { key: 'net.ipv4.icmp_echo_ignore_broadcasts', value: '1' }
|
|
- { key: 'net.ipv4.conf.all.accept_source_route', value: '0' }
|
|
- { key: 'net.ipv4.conf.default.accept_source_route', value: '0' }
|
|
- { key: 'net.ipv4.conf.all.send_redirects', value: '0' }
|
|
- { key: 'net.ipv4.conf.default.send_redirects', value: '0' }
|
|
- { key: 'net.ipv4.tcp_syncookies', value: '1' }
|
|
- { key: 'net.ipv4.conf.all.log_martians', value: '1' }
|
|
- { key: 'kernel.randomize_va_space', value: '2' }
|
|
|
|
- name: "🔒 Install fail2ban"
|
|
ansible.builtin.apt:
|
|
name: fail2ban
|
|
state: present
|
|
when: security.fail2ban_enabled | default(true)
|
|
|
|
- name: "🔒 Configure fail2ban"
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 5
|
|
|
|
[sshd]
|
|
enabled = true
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
when: security.fail2ban_enabled | default(true)
|
|
notify: restart fail2ban
|
|
|
|
- name: "🔒 Enable unattended upgrades"
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
when: security.unattended_upgrades | default(true)
|
|
|
|
- name: "🔒 Configure automatic security updates"
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
content: |
|
|
Unattended-Upgrade::Allowed-Origins {
|
|
"${distro_id}:${distro_codename}-security";
|
|
};
|
|
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
|
Unattended-Upgrade::MinimalSteps "true";
|
|
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
|
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
|
Unattended-Upgrade::Automatic-Reboot "false";
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
when: security.unattended_upgrades | default(true)
|