Bez popisu
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

security.yml 1.2KB

12345678910111213141516171819202122232425262728293031323334353637383940
  1. - name: Install security-related packages
  2. apt:
  3. name: "{{ packages }}"
  4. state: present
  5. vars:
  6. packages:
  7. - whois
  8. - lynis
  9. - rkhunter
  10. tags:
  11. - dependencies
  12. - name: add stretch-backport for fail2ban with IPv6 support
  13. apt_repository: repo='deb http://deb.debian.org/debian stretch-backports main' state=present update_cache=yes
  14. - name: Install newer fail2ban with IPv6 support
  15. apt:
  16. name: "fail2ban"
  17. state: present
  18. default_release: stretch-backports
  19. tags:
  20. - dependencies
  21. - name: Copy fail2ban configuration into place
  22. template: src=etc_fail2ban_jail.local.j2 dest=/etc/fail2ban/jail.local
  23. notify: restart fail2ban
  24. - name: Copy fail2ban dovecot configuration into place
  25. copy: src=etc_fail2ban_filter.d_dovecot-pop3imap.conf dest=/etc/fail2ban/filter.d/dovecot-pop3imap.conf
  26. notify: restart fail2ban
  27. - name: Ensure fail2ban is started
  28. service: name=fail2ban state=started
  29. - name: Update sshd config for PFS and more secure defaults
  30. template: src=etc_ssh_sshd_config.j2 dest=/etc/ssh/sshd_config
  31. notify: restart ssh
  32. - name: Update ssh config for more secure defaults
  33. template: src=etc_ssh_ssh_config.j2 dest=/etc/ssh/ssh_config