Initial ansible onboard

ansible/roles/cis_hardening/tasks/postfix.yml

@@ -0,0 +1,56 @@
+---
+- name: Stat postfix main.cf
+  ansible.builtin.stat:
+    path: /etc/postfix/main.cf
+  register: postfix_main_cf
+  tags:
+    - packages
+    - postfix
+
+- name: Configure Postfix disable_vrfy_command
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "^disable_vrfy_command"
+    dest: /etc/postfix/main.cf
+    line: "disable_vrfy_command = yes"
+    state: present
+  when: postfix_main_cf.stat.exists
+  tags:
+    - packages
+    - postfix
+
+- name: Configure Postfix inet_interfaces
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "^inet_interfaces"
+    dest: /etc/postfix/main.cf
+    line: "inet_interfaces = loopback-only"
+    state: present
+  when: postfix_main_cf.stat.exists
+  tags:
+    - packages
+    - postfix
+
+- name: Configure Postfix smtpd_banner
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "^smtpd_banner"
+    dest: /etc/postfix/main.cf
+    line: 'smtpd_banner = \$myhostname - ESMTP'
+    state: present
+  when: postfix_main_cf.stat.exists
+  tags:
+    - packages
+    - postfix
+
+- name: Configure Postfix smtpd_client_restrictions
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "^smtpd_client_restrictions"
+    dest: /etc/postfix/main.cf
+    line: "smtpd_client_restrictions = permit_mynetworks,reject"
+  when: postfix_main_cf.stat.exists
+  tags:
+    - packages
+    - postfix
+...