156 lines
4.0 KiB
YAML
156 lines
4.0 KiB
YAML
|
---
|
||
|
|
- name: Install local facts
|
||
|
|
ansible.builtin.include_tasks: facts.yml
|
||
|
|
tags: always
|
||
|
|
|
||
|
|
- name: Configure systemd resolved
|
||
|
|
ansible.builtin.include_tasks: resolvedconf.yml
|
||
|
|
tags: always
|
||
|
|
|
||
|
|
- name: Install epel-release and python dependencies
|
||
|
|
ansible.builtin.include_tasks: pre.yml
|
||
|
|
tags: always
|
||
|
|
|
||
|
|
- name: Install and configure UFW
|
||
|
|
ansible.builtin.include_tasks:
|
||
|
|
file: ufw.yml
|
||
|
|
apply:
|
||
|
|
environment:
|
||
|
|
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||
|
|
when: ufw_enable
|
||
|
|
tags:
|
||
|
|
- ufw
|
||
|
|
|
||
|
|
- name: Configure sysctl
|
||
|
|
ansible.builtin.include_tasks: sysctl.yml
|
||
|
|
|
||
|
|
- name: Disable kernel network modules
|
||
|
|
ansible.builtin.include_tasks: disablenet.yml
|
||
|
|
|
||
|
|
- name: Disable file system kernel modules
|
||
|
|
ansible.builtin.include_tasks: disablefs.yml
|
||
|
|
|
||
|
|
- name: Disable IPv6
|
||
|
|
ansible.builtin.include_tasks: ipv6.yml
|
||
|
|
when: disable_ipv6
|
||
|
|
|
||
|
|
- name: Configure systemd system and users
|
||
|
|
ansible.builtin.include_tasks: systemdconf.yml
|
||
|
|
|
||
|
|
- name: Configure systemd journald and logrotate
|
||
|
|
ansible.builtin.include_tasks: journalconf.yml
|
||
|
|
|
||
|
|
- name: Configure systemd timesyncd
|
||
|
|
ansible.builtin.include_tasks: timesyncd.yml
|
||
|
|
|
||
|
|
- name: Clean fstab
|
||
|
|
ansible.builtin.include_tasks: fstab.yml
|
||
|
|
|
||
|
|
- name: Configure shm and tmp mounts
|
||
|
|
ansible.builtin.include_tasks: mount.yml
|
||
|
|
|
||
|
|
- name: Disable prelink
|
||
|
|
ansible.builtin.include_tasks: prelink.yml
|
||
|
|
|
||
|
|
- name: Configure package managers, update caches and install updates
|
||
|
|
ansible.builtin.include_tasks: packagemgmt.yml
|
||
|
|
|
||
|
|
- name: Configure hosts.allow and hosts.deny
|
||
|
|
when: not custom_hosts_acls
|
||
|
|
ansible.builtin.include_tasks: hosts.yml
|
||
|
|
|
||
|
|
- name: Configure login.defs
|
||
|
|
ansible.builtin.include_tasks: logindefs.yml
|
||
|
|
|
||
|
|
- name: Set limits
|
||
|
|
ansible.builtin.include_tasks: limits.yml
|
||
|
|
|
||
|
|
- name: Configure adduser and useradd
|
||
|
|
ansible.builtin.include_tasks: adduser.yml
|
||
|
|
|
||
|
|
- name: Restrict root access
|
||
|
|
ansible.builtin.include_tasks: rootaccess.yml
|
||
|
|
|
||
|
|
- name: Configure needrestart, install and remove various packages
|
||
|
|
ansible.builtin.include_tasks: packages.yml
|
||
|
|
|
||
|
|
- name: Configure ssh server and client
|
||
|
|
ansible.builtin.include_tasks: sshconfig.yml
|
||
|
|
|
||
|
|
- name: Configure PAM
|
||
|
|
ansible.builtin.include_tasks: password.yml
|
||
|
|
|
||
|
|
- name: Configure and clean at and cron
|
||
|
|
ansible.builtin.include_tasks: cron.yml
|
||
|
|
|
||
|
|
- name: Disable systemd ctrl-alt-del.target
|
||
|
|
ansible.builtin.include_tasks: ctrlaltdel.yml
|
||
|
|
|
||
|
|
- name: Configure auditd
|
||
|
|
ansible.builtin.include_tasks: auditd.yml
|
||
|
|
|
||
|
|
- name: Configure AppArmor
|
||
|
|
ansible.builtin.include_tasks: apparmor.yml
|
||
|
|
|
||
|
|
- name: Disable misc kernel modules
|
||
|
|
ansible.builtin.include_tasks: disablemod.yml
|
||
|
|
|
||
|
|
- name: Disable wireless interfaces
|
||
|
|
ansible.builtin.include_tasks: disablewireless.yml
|
||
|
|
when: disable_wireless
|
||
|
|
|
||
|
|
# https://bugs.launchpad.net/ubuntu/+source/aide/+bug/1903298
|
||
|
|
- name: Configure AIDE
|
||
|
|
ansible.builtin.include_tasks: aide.yml
|
||
|
|
when: >
|
||
|
|
install_aide | bool and
|
||
|
|
(not (ansible_os_family == "Debian" and
|
||
|
|
(ansible_lsb.codename == "groovy" or
|
||
|
|
ansible_lsb.codename == "hirsute")))
|
||
|
|
|
||
|
|
- name: Manage users
|
||
|
|
ansible.builtin.include_tasks: users.yml
|
||
|
|
|
||
|
|
- name: Remove suid/sgid permissions
|
||
|
|
ansible.builtin.include_tasks: suid.yml
|
||
|
|
when: suid_sgid_permissions | bool
|
||
|
|
|
||
|
|
- name: Configure compiler permissions
|
||
|
|
ansible.builtin.include_tasks: compilers.yml
|
||
|
|
|
||
|
|
- name: Set umask
|
||
|
|
ansible.builtin.include_tasks: umask.yml
|
||
|
|
|
||
|
|
- name: Configure paths
|
||
|
|
ansible.builtin.include_tasks: path.yml
|
||
|
|
|
||
|
|
- name: Configure systemd logind
|
||
|
|
ansible.builtin.include_tasks: logindconf.yml
|
||
|
|
|
||
|
|
- name: Configure rkhunter
|
||
|
|
ansible.builtin.include_tasks: rkhunter.yml
|
||
|
|
|
||
|
|
- name: Add issue message
|
||
|
|
ansible.builtin.include_tasks: issue.yml
|
||
|
|
|
||
|
|
- name: Configure apport
|
||
|
|
ansible.builtin.include_tasks: apport.yml
|
||
|
|
|
||
|
|
- name: Lock root account
|
||
|
|
ansible.builtin.include_tasks: lockroot.yml
|
||
|
|
|
||
|
|
- name: Configure Postfix
|
||
|
|
ansible.builtin.include_tasks: postfix.yml
|
||
|
|
|
||
|
|
- name: Configure motdnews
|
||
|
|
ansible.builtin.include_tasks: motdnews.yml
|
||
|
|
|
||
|
|
- name: Configure sudo
|
||
|
|
ansible.builtin.include_tasks: sudo.yml
|
||
|
|
|
||
|
|
- name: Miscellaneous extra tasks
|
||
|
|
ansible.builtin.include_tasks: extras.yml
|
||
|
|
|
||
|
|
- name: Miscellaneous tasks after all handlers
|
||
|
|
ansible.builtin.include_tasks: post.yml
|