Encryption and major changes

2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
@@ -0,0 +1,264 @@
+---
+- name: Configure apt
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/apt/apt.conf.d/98-hardening-ubuntu
+    mode: "0644"
+    state: present
+    create: true
+    line: "{{ item }}"
+  with_items:
+    - 'Acquire::AllowDowngradeToInsecureRepositories "false";'
+    - 'Acquire::AllowInsecureRepositories "false";'
+    - 'Acquire::http::AllowRedirect "false";'
+    - 'APT::Get::AllowUnauthenticated "false";'
+    - 'APT::Get::AutomaticRemove "true";'
+    - 'APT::Install-Recommends "false";'
+    - 'APT::Install-Suggests "false";'
+    - 'APT::Periodic::AutocleanInterval "7";'
+    - 'APT::Sandbox::Seccomp "1";'
+    - 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
+    - 'Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";'
+    - 'Unattended-Upgrade::Automatic-Reboot "{{ unattended_reboot }}";'
+    - 'Unattended-Upgrade::Automatic-Reboot-WithUsers "true";'
+    - 'Unattended-Upgrade::Automatic-Reboot-Time "{{ unattended_reboot_time }}";'
+
+  when: ansible_os_family == "Debian"
+  tags:
+    - apt
+    - M1045
+
+- name: Run apt update
+  become: true
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 1800
+  notify:
+    - Run apt-get clean
+    - Run apt-get autoremove
+  when: ansible_os_family == "Debian"
+  tags:
+    - apt
+
+- name: Run apt upgrade
+  become: true
+  ansible.builtin.apt:
+    upgrade: safe
+  register: apt_upgrade_response
+  changed_when: apt_upgrade_response.stdout.find('0 upgraded') == -1
+  when: ansible_os_family == "Debian" and system_upgrade | bool
+  tags:
+    - apt
+    - CIS-UBUNTU2004-1.9
+    - D3-SU
+    - M1051
+
+- name: Link dnf.conf
+  become: true
+  ansible.builtin.file:
+    src: /etc/dnf/dnf.conf
+    dest: /etc/yum.conf
+    owner: root
+    group: root
+    state: link
+  when: ansible_distribution == "Fedora"
+  tags:
+    - dnf
+    - yum
+
+- name: Import RedHat RPM key
+  become: true
+  ansible.builtin.rpm_key:
+    state: present
+    key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
+  with_items:
+    - "{{ redhat_signing_keys }}"
+  when: ansible_os_family == "RedHat"
+  tags:
+    - dnf
+    - yum
+    - CCE-80795-8
+
+- name: Set yum.conf gpgcheck
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "^gpgcheck="
+    line: "gpgcheck=1"
+    dest: /etc/yum.conf
+    mode: "0644"
+    state: present
+    create: false
+    backrefs: true
+  when: ansible_os_family == "RedHat"
+  tags:
+    - dnf
+    - yum
+    - CCE-80790-9
+    - CCE-80792-5
+    - M1045
+
+- name: Set yum.conf clean_requirements
+  become: true
+  ansible.builtin.lineinfile:
+    line: "clean_requirements_on_remove=True"
+    dest: /etc/yum.conf
+    mode: "0644"
+    state: present
+    create: true
+    insertafter: "[main]"
+  when: ansible_os_family == "RedHat"
+  tags:
+    - dnf
+    - yum
+    - CCE-82476-3
+
+- name: Set yum.conf localpkg_gpgcheck
+  become: true
+  ansible.builtin.lineinfile:
+    line: "localpkg_gpgcheck=1"
+    dest: /etc/yum.conf
+    mode: "0644"
+    state: present
+    create: true
+    insertafter: "[main]"
+  when: ansible_os_family == "RedHat"
+  tags:
+    - dnf
+    - yum
+    - CCE-80791-7
+    - M1045
+
+- name: Comment yum.conf repo_gpgcheck
+  become: true
+  ansible.builtin.lineinfile:
+    line: "# repo_gpgcheck=1"
+    dest: /etc/yum.conf
+    mode: "0644"
+    state: present
+    create: true
+    insertafter: "[main]"
+  when: ansible_os_family == "RedHat"
+  tags:
+    - dnf
+    - yum
+
+- name: RHEL8 package management tasks
+  when: ansible_distribution == "RedHat" and ansible_distribution_major_version == "8"
+  block:
+    - name: Import RHEL8 necessary GPG keys
+      become: true
+      ansible.builtin.rpm_key:
+        state: present
+        key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
+      with_items:
+        - "{{ epel8_signing_keys }}"
+      tags:
+        - dnf
+        - packages
+        - yum
+
+    - name: RHEL8 EPEL repo installation
+      become: true
+      ansible.builtin.dnf:
+        name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm"
+        state: present
+      tags:
+        - dnf
+        - packages
+        - yum
+
+    - name: Install CodeReady repo for RHEL8
+      become: true
+      ansible.builtin.command: subscription-manager repos --enable "codeready-builder-for-rhel-8-{{ ansible_architecture }}-rpms"
+      changed_when: false
+
+- name: RHEL7 repo tasks
+  when: ansible_distribution == "RedHat" and ansible_distribution_major_version == "7"
+  block:
+    - name: Import RHEL7 necessary GPG keys
+      become: true
+      ansible.builtin.rpm_key:
+        state: present
+        key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
+      with_items:
+        - "{{ epel7_signing_keys }}"
+      tags:
+        - dnf
+        - packages
+        - yum
+
+    - name: RHEL7 EPEL repo installation
+      become: true
+      ansible.builtin.dnf:
+        name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm"
+        state: present
+      tags:
+        - dnf
+        - packages
+        - yum
+
+    - name: Install Extras and HA for RHEL7
+      become: true
+      ansible.builtin.command: subscription-manager repos --enable "rhel-*-optional-rpms" --enable "rhel-*-extras-rpms"  --enable "rhel-ha-for-rhel-*-server-rpms"
+      changed_when: false
+      tags:
+        - dnf
+        - packages
+        - yum
+
+- name: Stat PowerTools repository files
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  with_items:
+    - /etc/yum.repos.d/almalinux-crb.repo
+    - /etc/yum.repos.d/almalinux-powertools.repo
+    - /etc/yum.repos.d/CentOS-Linux-PowerTools.repo
+    - /etc/yum.repos.d/CentOS-PowerTools.repo
+    - /etc/yum.repos.d/CentOS-Stream-PowerTools.repo
+  register: powertools_repo
+  when: ansible_os_family == "RedHat"
+  tags:
+    - dnf
+    - packages
+    - yum
+
+- name: Enable the PowerTools repository
+  become: true
+  ansible.builtin.replace:
+    regexp: "^enabled=.*$"
+    replace: "enabled=1"
+    dest: "{{ item.stat.path }}"
+  with_items:
+    - "{{ powertools_repo.results }}"
+  when: ansible_os_family == "RedHat" and item.stat.exists
+  tags:
+    - dnf
+    - packages
+    - yum
+
+- name: Update dnf cache
+  become: true
+  ansible.builtin.dnf:
+    update_cache: true
+  when: ansible_os_family == "RedHat"
+  notify:
+    - Run dnf autoremove
+  tags:
+    - dnf
+    - yum
+
+- name: Run dnf upgrade
+  become: true
+  ansible.builtin.dnf:
+    name: "*" # noqa package-latest
+    state: latest
+    bugfix: true
+    security: true
+    nobest: true
+  when: ansible_os_family == "RedHat" and system_upgrade | bool
+  tags:
+    - dnf
+    - yum
+    - CCE-80865-9
+    - D3-SU
+    - M1051