sovereign

提交線圖

作者	SHA1	備註	提交日期
Alex Payne	6906412f63	Remove wheezy-specific ufw task.	9 年之前
Alex Payne	6d1eebb9d2	Use Ansible task names, not comments.	9 年之前
Alex Payne	c9b32cd2e2	Same Google auth install should work for both Jessie and Trusty. Move Apache task to their own file.	9 年之前
Alex Payne	006f8e9b82	Just plain Ruby	9 年之前
Laurent Arnoud	a09e2e71c1	tar used in place of unarchive module	9 年之前
Laurent Arnoud	311fae7e11	Trailing whitespace	9 年之前
Laurent Arnoud	3b8f15b745	Added whois for fail2ban report Report will print: "missing whois program"	9 年之前
Will McCutchen	1be1afe1ff	Disable SSL stapling on wheezy	9 年之前
Will McCutchen	16b66cc849	Define apache SSL config in one place	9 年之前
Manfred Touron	16c93ea486	Using more verbose 'dependencies' tag (#393)	9 年之前
Manfred Touron	b49f3a6586	Tagged 'deps' aptitude tasks	9 年之前
Laurent Arnoud	353e69d299	Remove duplication with items unattended upgrades	9 年之前
Laurent Arnoud	89d47731ff	Add molly-guard and unattended-upgrades as common pkgs	9 年之前
Alex Payne	b11fb68559	Automatically set up passwordless sudo for deploy user. Closes #343.	9 年之前
Aleksandr Bogdanov	a849948e8d	Choosing the closest ubuntu mirror before anything else	9 年之前
Sven Neuhaus	ae58053653	Create /decrypted directory even if encfs is not used. Helps with issue #120.	9 年之前
Sven Neuhaus	d5217ea1cd	Create main user without "fuse" group, instead add it later as part of the "encfs" tag. This allows the user to make encfs optional. Helps with issue #120.	9 年之前
Marius Voila	b13ab39f11	cleaning security.yml	9 年之前
fengor	7ed46f590c	renamed templates to be consistent with coding standard. removed comment line in ssh_config	9 年之前
Marius Voila	ec69fef60c	removed old template	9 年之前
Marius Voila	2ae2c3683c	removed template and implemented logic	9 年之前
fengor	2fd1e1b722	readded google authenticator lines	9 年之前
fengor	224e8cb339	Setting timezone to UTC	9 年之前
fengor	39566abb6c	More secure defaults for ssh. Ciphers, Kex and MAC can be set via defaults.var	9 年之前
Marius Voila	67e1bf0fc3	fail2ban support for Trusty	9 年之前
Marius Voila	e62bd7c71a	fail2ban support for Trusty	9 年之前
Anthony Perez-sanz	cdf9ed07bb	Enable UFW after setting firewall rules On fresh installs of Debian 7.6, the current order of steps will lock you out of SSH. This will enable UFW after creating rules for http, https, ssh, and DNS. Fix comes from @Debugreality in issue #303: https://github.com/al3x/sovereign/issues/303	9 年之前
Lorenzo Villani	5d1090d488	Make sure fail2ban is started	10 年之前
Lorenzo Villani	d5ecf673d3	Calm OCD by sorting almost every with_items block in alphabetical order	10 年之前
Lorenzo Villani	e7703d0d9c	Add support for Apache 2.4 on Ubuntu 14.04	10 年之前
Lorenzo Villani	e2e61a2f76	Install 'fuse' instead of 'fuse-utils' The 'fuse-utils' package doesn't exist on Ubuntu 14.04 and is marked as a transitional package on both Debian 7 and Ubuntu 12.04 that installs the 'fuse' package. Since Debian 7 is the officially supported distribution we can safely switch to install 'fuse' instead of 'fuse-utils' and we also gain compatibility with Ubuntu 14.04.	10 年之前
Sven Neuhaus	63ba754eb7	libpam-google-authenticator uses distribution package on Ubuntu 14.04	10 年之前
Gelnior	7995bac36c	put back enc.fs (removed by mistake)	10 年之前
Gelnior	bd57edd5a5	newebe config: fix Newebe config file task	10 年之前
Justin Plock	1d7986fd96	Enable UFW and deny everything by default Removed unused status checks on UFW	10 年之前
Justin Plock	ea0b288818	Moved ufw firewall rules into individual roles	10 年之前
Justin Plock	ed75c9469b	libpam-dev didn't exist for some people so switching to libpam0g-dev instead	10 年之前
Justin Plock	e88fb57cba	Skip the google authenticator generation if we're running as vagrant. Vagrant can't sudo to the sovereign test user so this won't work.	10 年之前
Justin Plock	2d751ab680	The .google_authenticator file has to be generated by the user that is going to attempt to use it. Also, -W doesn't seem to work (results an in INVALID_WINDOW error in /var/log/auth.log), so use -w 1 to allow for a single concurrent token	10 年之前
Justin Plock	c037dce07a	Clarified parameters are bit in a comment	10 年之前
Justin Plock	22a8717f6d	Automatically generate the Google authenticator file for the default user	10 年之前
Justin Plock	84c9febec7	Added Google Authenticator 2FA logins	10 年之前
Justin Plock	89f018bd23	In preparation for using any 2FA solution, it will most likely need to modify sshd_config, so let's change the file in place instead of overwriting it completely.	10 年之前
Justin Plock	9f918363b9	Set a ServerName for apache (fixes #187)	10 年之前
Benjamin Reitzammer	d957760697	Making main user's shell configurable	10 年之前
Justin Plock	3b0308d69e	Allow both TCP and UDP port 53 for DNS lookups through OpenVPN	10 年之前
Joost Baaij	ae2e74bb79	make NTP pool configurable use the world-wide pool by default, but specify north-america in user.yml. Also, documentation. This way Sovereign will still behave the same, but the NTP servers can be changed when desired.	10 年之前
Joost Baaij	4837d2e87a	extract NTP logic	10 年之前
Joost Baaij	715399a2f1	added pop3s and imaps ports to fail2ban. Otherwise only pop and imap (un-secured) are blocked. Which we don't use.	10 年之前
Joost Baaij	2033c37982	Enabled unattended-upgrades This works on Debian/Ubuntu only. There are similar packages for other distributions, but they still need manual configuration. It seemed better to go for the common denominator. unattended-upgrades is usually installed by default anyway, so we are just reinforcing best practices.	10 年之前

99 次程式碼提交 (b674035d21853e8b0b1aecbe01f4c54e797e240a)