Daniel Allaire
b775b7f99d
Suppression de toute trace Chezlepro de l'outil (roles, scripts, docs publiques, exemples, LICENSE). Prouve par scan exhaustif : git grep vide pour chezlepro, asgard/TrueNAS, supernet reel 10.1.x. Corrige 5 defauts de genericite fonctionnels (motd, app.ini Forgejo, organisation openldap, nom AC step-ca, et IP reelles codees en dur dans les defaults de roles -> plage d'exemple 10.0.x). LICENSE -> Alliance Boreale. Fichiers mainteneur + CHANGELOG conserves (par decision). La separation moteur/instance tient : OPS-Chezlepro surcharge deja ses vraies valeurs de topologie. Verifie : make verifier exit 0 (4 tests). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
130 lines
5 KiB
YAML
130 lines
5 KiB
YAML
---
|
|
- name: Vérifier le template Debian 13 Proxmox
|
|
hosts: modeles_vm
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Vérifier que la cible est Debian 13
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_facts.distribution == "Debian"
|
|
- ansible_facts.distribution_major_version == "13"
|
|
fail_msg: "Ce template doit être une Debian 13."
|
|
|
|
- name: Afficher les partitions
|
|
ansible.builtin.command: lsblk -f
|
|
register: lsblk_output
|
|
changed_when: false
|
|
|
|
- name: Résultat lsblk
|
|
ansible.builtin.debug:
|
|
var: lsblk_output.stdout_lines
|
|
|
|
- name: Vérifier l'absence de swap actif
|
|
ansible.builtin.command: swapon --show
|
|
register: swapon_output
|
|
changed_when: false
|
|
failed_when: swapon_output.stdout | length > 0
|
|
|
|
- name: Collecter les paquets installés
|
|
ansible.builtin.package_facts:
|
|
manager: auto
|
|
|
|
- name: Valider les paquets requis du template
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'sudo' in ansible_facts.packages"
|
|
- "'openssh-server' in ansible_facts.packages"
|
|
- "'qemu-guest-agent' in ansible_facts.packages"
|
|
- "'cloud-init' in ansible_facts.packages"
|
|
- "'cloud-guest-utils' in ansible_facts.packages"
|
|
- "'chrony' in ansible_facts.packages"
|
|
- "'apparmor' in ansible_facts.packages"
|
|
- "'auditd' in ansible_facts.packages"
|
|
- "'fail2ban' in ansible_facts.packages"
|
|
- "'nftables' in ansible_facts.packages"
|
|
- "'unattended-upgrades' in ansible_facts.packages"
|
|
fail_msg: "Un paquet requis du golden template est absent."
|
|
|
|
- name: Vérifier l'absence d'environnement graphique
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'task-desktop' not in ansible_facts.packages"
|
|
- "'xserver-xorg' not in ansible_facts.packages"
|
|
- "'gdm3' not in ansible_facts.packages"
|
|
- "'sddm' not in ansible_facts.packages"
|
|
- "'lightdm' not in ansible_facts.packages"
|
|
fail_msg: "Un environnement graphique semble installé."
|
|
|
|
- name: Collecter les services
|
|
ansible.builtin.service_facts:
|
|
|
|
- name: Valider les services de base
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_facts.services['ssh.service'].state == 'running'
|
|
- ansible_facts.services['qemu-guest-agent.service'].state == 'running'
|
|
- ansible_facts.services['chrony.service'].state == 'running'
|
|
- ansible_facts.services['auditd.service'].state == 'running'
|
|
- ansible_facts.services['fail2ban.service'].state == 'running'
|
|
fail_msg: "Un service de base n'est pas actif."
|
|
|
|
- name: Vérifier que AppArmor est actif
|
|
ansible.builtin.command: aa-enabled
|
|
register: apparmor_state
|
|
changed_when: false
|
|
|
|
- name: Valider l'état nftables du template
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_facts.services['nftables.service'].state != 'running'
|
|
fail_msg: "nftables ne doit pas être actif par défaut dans le template."
|
|
|
|
- name: Vérifier cloud-init
|
|
ansible.builtin.command: cloud-init --version
|
|
register: cloud_init_version
|
|
changed_when: false
|
|
|
|
- name: Afficher cloud-init
|
|
ansible.builtin.debug:
|
|
var: cloud_init_version.stdout
|
|
|
|
- name: Vérifier sudo NOPASSWD du compte Ansible
|
|
ansible.builtin.command: sudo -n true
|
|
become: false
|
|
changed_when: false
|
|
|
|
- name: Collecter la configuration SSH effective
|
|
ansible.builtin.command: sshd -T
|
|
register: sshd_effective_config
|
|
changed_when: false
|
|
|
|
- name: Valider le hardening SSH effectif
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'passwordauthentication no' in sshd_effective_config.stdout"
|
|
- "'kbdinteractiveauthentication no' in sshd_effective_config.stdout"
|
|
- "'permitrootlogin no' in sshd_effective_config.stdout"
|
|
- "'pubkeyauthentication yes' in sshd_effective_config.stdout"
|
|
- "'authenticationmethods publickey' in sshd_effective_config.stdout"
|
|
- "'x11forwarding no' in sshd_effective_config.stdout"
|
|
- "'allowtcpforwarding no' in sshd_effective_config.stdout"
|
|
- "'allowagentforwarding no' in sshd_effective_config.stdout"
|
|
- "'allowstreamlocalforwarding no' in sshd_effective_config.stdout"
|
|
- "'permittunnel no' in sshd_effective_config.stdout"
|
|
- "'permituserenvironment no' in sshd_effective_config.stdout"
|
|
- "'maxauthtries 3' in sshd_effective_config.stdout"
|
|
- "'logingracetime 20' in sshd_effective_config.stdout"
|
|
- "'maxsessions 2' in sshd_effective_config.stdout"
|
|
fail_msg: "La configuration SSH effective ne respecte pas le hardening attendu."
|
|
|
|
- name: Vérifier les erreurs critiques du boot courant
|
|
ansible.builtin.command: journalctl -b -p err..alert --no-pager
|
|
register: boot_errors
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Afficher les erreurs du boot courant
|
|
ansible.builtin.debug:
|
|
var: boot_errors.stdout_lines
|