Manfred Touron
16c93ea486
Using more verbose 'dependencies' tag (#393 )
il y a 9 ans
Manfred Touron
b49f3a6586
Tagged 'deps' aptitude tasks
il y a 9 ans
Laurent Arnoud
353e69d299
Remove duplication with items unattended upgrades
il y a 9 ans
Laurent Arnoud
89d47731ff
Add molly-guard and unattended-upgrades as common pkgs
il y a 9 ans
Alex Payne
b11fb68559
Automatically set up passwordless sudo for deploy user.
Closes #343 .
il y a 9 ans
Aleksandr Bogdanov
a849948e8d
Choosing the closest ubuntu mirror before anything else
il y a 9 ans
Sven Neuhaus
ae58053653
Create /decrypted directory even if encfs is not used.
Helps with issue #120 .
il y a 9 ans
Sven Neuhaus
d5217ea1cd
Create main user without "fuse" group, instead add it later as part
of the "encfs" tag. This allows the user to make encfs optional.
Helps with issue #120 .
il y a 9 ans
Marius Voila
b13ab39f11
cleaning security.yml
il y a 9 ans
fengor
7ed46f590c
renamed templates to be consistent with coding standard.
removed comment line in ssh_config
il y a 9 ans
fengor
2fd1e1b722
readded google authenticator lines
il y a 9 ans
fengor
224e8cb339
Setting timezone to UTC
il y a 9 ans
fengor
39566abb6c
More secure defaults for ssh.
Ciphers, Kex and MAC can be set via defaults.var
il y a 9 ans
Marius Voila
e62bd7c71a
fail2ban support for Trusty
il y a 9 ans
Anthony Perez-sanz
cdf9ed07bb
Enable UFW after setting firewall rules
On fresh installs of Debian 7.6, the current order of steps will lock you
out of SSH. This will enable UFW after creating rules for http, https, ssh,
and DNS. Fix comes from @Debugreality in issue #303 :
https://github.com/al3x/sovereign/issues/303
il y a 9 ans
Lorenzo Villani
5d1090d488
Make sure fail2ban is started
il y a 10 ans
Lorenzo Villani
d5ecf673d3
Calm OCD by sorting almost every with_items block in alphabetical order
il y a 10 ans
Lorenzo Villani
e7703d0d9c
Add support for Apache 2.4 on Ubuntu 14.04
il y a 10 ans
Lorenzo Villani
e2e61a2f76
Install 'fuse' instead of 'fuse-utils'
The 'fuse-utils' package doesn't exist on Ubuntu 14.04 and is marked as a
transitional package on both Debian 7 and Ubuntu 12.04 that installs the
'fuse' package.
Since Debian 7 is the officially supported distribution we can safely
switch to install 'fuse' instead of 'fuse-utils' and we also gain
compatibility with Ubuntu 14.04.
il y a 10 ans
Sven Neuhaus
63ba754eb7
libpam-google-authenticator uses distribution package on Ubuntu 14.04
il y a 10 ans
Gelnior
7995bac36c
put back enc.fs (removed by mistake)
il y a 10 ans
Gelnior
bd57edd5a5
newebe config: fix Newebe config file task
il y a 10 ans
Justin Plock
1d7986fd96
Enable UFW and deny everything by default
Removed unused status checks on UFW
il y a 10 ans
Justin Plock
ea0b288818
Moved ufw firewall rules into individual roles
il y a 10 ans
Justin Plock
ed75c9469b
libpam-dev didn't exist for some people so switching to libpam0g-dev instead
il y a 10 ans
Justin Plock
e88fb57cba
Skip the google authenticator generation if we're running as vagrant. Vagrant can't sudo to the sovereign test user so this won't work.
il y a 10 ans
Justin Plock
2d751ab680
The .google_authenticator file has to be generated by the user that is going to attempt to use it. Also, -W doesn't seem to work (results an in INVALID_WINDOW error in /var/log/auth.log), so use -w 1 to allow for a single concurrent token
il y a 10 ans
Justin Plock
c037dce07a
Clarified parameters are bit in a comment
il y a 10 ans
Justin Plock
22a8717f6d
Automatically generate the Google authenticator file for the default user
il y a 10 ans
Justin Plock
84c9febec7
Added Google Authenticator 2FA logins
il y a 10 ans
Justin Plock
89f018bd23
In preparation for using any 2FA solution, it will most likely need to modify sshd_config, so let's change the file in place instead of overwriting it completely.
il y a 10 ans
Justin Plock
9f918363b9
Set a ServerName for apache (fixes #187 )
il y a 10 ans
Benjamin Reitzammer
d957760697
Making main user's shell configurable
il y a 10 ans
Justin Plock
3b0308d69e
Allow both TCP and UDP port 53 for DNS lookups through OpenVPN
il y a 10 ans
Joost Baaij
4837d2e87a
extract NTP logic
il y a 10 ans
Joost Baaij
2033c37982
Enabled unattended-upgrades
This works on Debian/Ubuntu only.
There are similar packages for other distributions, but they still
need manual configuration. It seemed better to go for the common
denominator. unattended-upgrades is usually installed by default
anyway, so we are just reinforcing best practices.
il y a 10 ans
Joost Baaij
335cef5c9f
Enabled POP3S for old-timeys who dig that
added dovecot-pop3d
allowed in the firewall
monitored with monit
added relevant tests
il y a 10 ans
Joshua Lund
4ed07a1e0a
* Made the OpenVPN port and protocol (tcp/udp) configurable
* Added 'cipher' and 'auth' lines to the generated client configs
il y a 10 ans
Luke Cyca
4bc4cebf41
Explicit permissions for all cert files
il y a 10 ans
Luke Cyca
76d52b63f3
XMPP cert handling improvements, ufw rules, and tests
il y a 10 ans
Alex Payne
f7f7157cec
more updated variable formatting and accommodation of the YAML parser being a fussbudget
il y a 10 ans
Alex Payne
34d7595c0b
ensure we can install from third-party repos across playbooks
il y a 10 ans
Alex Payne
d28f0f82b9
move to non-deprecated template variable formatting
il y a 10 ans
Luke Cyca
2f145ce543
Two small apache-related fixes
il y a 10 ans
Luke Cyca
37a0400c22
Standardize apache’s 301 redirect to https, and enable HSTS
il y a 10 ans
Luke Cyca
bdab1cd6b1
Reworked ufw logic to not use change_when keyword
because it's not available in a stable ansible release yet
il y a 11 ans
Allen Riddell
5b8ba840a4
workaround ufw bug, call ufw enable twice
il y a 11 ans
Allen Riddell
ae0d1ca8f4
Ignore ufw error resulting from known bug on Debian 7
In order to check the version of the linux distribution we need to
set `gather_facts` to True.
Closes #73 .
il y a 11 ans
Luke Cyca
7043143f90
Improved idempotency and removed ip detection for checkrbl
il y a 11 ans
Allen Riddell
88705bb7fa
Replace ferm with ufw
il y a 11 ans