44 lines
1.2 KiB
YAML
44 lines
1.2 KiB
YAML
|
---
|
||
|
|
- name: Set Debian ipv6.disable GRUB cmdline
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ipv6.disable=1"'
|
||
|
|
dest: /etc/default/grub.d/99-hardening-ipv6.cfg
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
mode: "0640"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
when: ansible_os_family == "Debian"
|
||
|
|
tags:
|
||
|
|
- ipv6
|
||
|
|
- CIS-UBUNTU2004-3.1.1
|
||
|
|
|
||
|
|
- name: Set RedHat ipv6.disable GRUB cmdline
|
||
|
|
become: true
|
||
|
|
ansible.builtin.command:
|
||
|
|
cmd: 'grubby --update-kernel=ALL --args="ipv6.disable=1"'
|
||
|
|
register: grubby_update_kernel
|
||
|
|
when: ansible_os_family == "RedHat"
|
||
|
|
changed_when: grubby_update_kernel.rc != 0
|
||
|
|
failed_when: grubby_update_kernel.rc != 0
|
||
|
|
tags:
|
||
|
|
- ipv6
|
||
|
|
|
||
|
|
- name: Configure sysctl to disable IPv6
|
||
|
|
become: true
|
||
|
|
environment:
|
||
|
|
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||
|
|
ansible.posix.sysctl:
|
||
|
|
name: "{{ item.key }}"
|
||
|
|
value: "{{ item.value | int }}"
|
||
|
|
state: present
|
||
|
|
sysctl_set: true
|
||
|
|
sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
|
||
|
|
when: system_has_ipv6 and disable_ipv6
|
||
|
|
with_dict: "{{ ipv6_disable_sysctl_settings }}"
|
||
|
|
notify:
|
||
|
|
- Restart sysctl
|
||
|
|
tags:
|
||
|
|
- ipv6
|