86 lines
2.4 KiB
YAML
86 lines
2.4 KiB
YAML
---
|
|
- name: Gate
|
|
ansible.builtin.meta: end_host
|
|
when: not hardening_common_enabled | bool
|
|
|
|
- name: Appliquer le socle sysctl
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
state: present
|
|
sysctl_set: true
|
|
reload: true
|
|
loop: "{{ hardening_common_sysctl | dict2items }}"
|
|
|
|
- name: Déployer le drop-in SSH durci
|
|
ansible.builtin.template:
|
|
src: sshd_boreale_hardening.conf.j2
|
|
dest: /etc/ssh/sshd_config.d/99-boreale-hardening.conf
|
|
mode: '0644'
|
|
validate: '/usr/sbin/sshd -T -f %s'
|
|
notify: Reload ssh
|
|
|
|
- name: Déployer le drop-in journald
|
|
ansible.builtin.template:
|
|
src: journald-boreale.conf.j2
|
|
dest: /etc/systemd/journald.conf.d/99-boreale.conf
|
|
mode: '0644'
|
|
when: hardening_common_journald_enabled | bool
|
|
notify: Restart journald
|
|
|
|
- name: Installer fail2ban
|
|
ansible.builtin.apt:
|
|
name: fail2ban
|
|
state: present
|
|
when: hardening_common_fail2ban_enabled | bool
|
|
|
|
- name: Déployer la jail sshd fail2ban
|
|
ansible.builtin.template:
|
|
src: jail-sshd.local.j2
|
|
dest: /etc/fail2ban/jail.d/sshd.local
|
|
mode: '0644'
|
|
when:
|
|
- hardening_common_fail2ban_enabled | bool
|
|
- hardening_common_fail2ban_sshd_enabled | bool
|
|
notify: Restart fail2ban
|
|
|
|
- name: Activer fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
enabled: true
|
|
state: started
|
|
when: hardening_common_fail2ban_enabled | bool
|
|
|
|
- name: Déployer unattended-upgrades auto
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
mode: '0644'
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
when: hardening_common_unattended_upgrades_enabled | bool
|
|
|
|
- name: Déployer unattended-upgrades de base
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
|
|
mode: '0644'
|
|
content: |
|
|
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
|
Unattended-Upgrade::Automatic-Reboot "false";
|
|
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
|
|
when: hardening_common_unattended_upgrades_enabled | bool
|
|
|
|
- name: Installer debsecan
|
|
ansible.builtin.apt:
|
|
name: debsecan
|
|
state: present
|
|
when: hardening_common_debsecan_enabled | bool
|
|
|
|
- name: Activer AppArmor
|
|
ansible.builtin.systemd:
|
|
name: apparmor
|
|
enabled: true
|
|
state: started
|
|
failed_when: false
|
|
when: hardening_common_apparmor_enabled | bool
|