summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2014-03-13 16:43:50 +0100
committerGuilhem Moulin <guilhem@fripost.org>2015-06-07 02:51:43 +0200
commitd72d516f2647a3e03b5e11d891c6ec4e9ddcf9cf (patch)
tree3d8e0f75a74d710aa1f0d84ce27daea302acb6e1
parent984708466b7c368e98a8b51c00acff5e6b870bd2 (diff)
Make use of Ansible 1.5 new features.
Most notably pipelining=True and sysctl_set=yes.
-rw-r--r--ansible.cfg36
-rw-r--r--roles/common/files/etc/logcheck/ignore.d.server/common.local4
-rw-r--r--roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo7
-rw-r--r--roles/common/tasks/logging.yml1
-rw-r--r--roles/common/tasks/rkhunter.yml2
-rw-r--r--roles/common/tasks/sysctl.yml2
6 files changed, 38 insertions, 14 deletions
diff --git a/ansible.cfg b/ansible.cfg
index 6afc1ef..82de41a 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -28,49 +28,57 @@ pattern = *
# the default number of forks (parallelism) to be used. Usually you
# can crank this up.
-forks=5
+forks = 5
# the timeout used by various connection types. Usually this corresponds
# to an SSH timeout
-timeout=10
+timeout = 10
# when using --poll or "poll:" in an ansible playbook, and not specifying
# an explicit poll interval, use this interval
-poll_interval=15
+poll_interval = 15
# when specifying --sudo to /usr/bin/ansible or "sudo:" in a playbook,
# and not specifying "--sudo-user" or "sudo_user" respectively, sudo
# to this user account
-sudo=True
-#sudo_user=root
+sudo = True
+#sudo_user = root
+
+# what flags to pass to sudo
+sudo_flags = -H LC_ALL=C
# the following forces ansible to always ask for the sudo password (instead of having
# to add -K to the commandline). Or you can use the environment variable (ANSIBLE_ASK_SUDO_PASS)
-ask_sudo_pass=True
+ask_sudo_pass = True
# the following forces ansible to always ask for the ssh-password (-k)
# can also be set by the environment variable ANSIBLE_ASK_PASS
-#ask_pass=True
+#ask_pass = True
# connection to use when -c <connection_type> is not specified
-transport=ssh
+transport = ssh
# remote SSH port to be used when --port or "port:" or an equivalent inventory
# variable is not specified.
-remote_port=22
+remote_port = 22
# if set, always run /usr/bin/ansible commands as this user, and assume this value
# if "user:" is not set in a playbook. If not set, use the current Unix user
# as the default
-#remote_user=root
+#remote_user = root
+
+# if set, always use this private key file for authentication, same as if passing
+# --private-key to ansible or ansible-playbook
+
+#private_key_file=/path/to/file
# format of string $ansible_managed available within Jinja2 templates, replacing
# {file}, {host} and {uid} with template filename, host and owner respectively.
@@ -88,11 +96,15 @@ connection_plugins = /usr/share/ansible_plugins/connection_plugins
lookup_plugins = /usr/share/ansible_plugins/lookup_plugins
vars_plugins = /usr/share/ansible_plugins/vars_plugins
-legacy_playbook_variables = no
-
[ssh_connection]
+# if uncommented, sets the ansible ssh arguments to the following. Leaving off ControlPersist
+# will result in poor performance, so use transport=paramiko on older platforms rather than
+# removing it
+
ssh_args = -F ../virtualenv/.ssh/config
-o ControlMaster=auto
-o ControlPersist=60s
-o ControlPath=/tmp/ansible-ssh-%h-%p-%r
+
+pipelining = True
diff --git a/roles/common/files/etc/logcheck/ignore.d.server/common.local b/roles/common/files/etc/logcheck/ignore.d.server/common.local
index 22fe621..331edeb 100644
--- a/roles/common/files/etc/logcheck/ignore.d.server/common.local
+++ b/roles/common/files/etc/logcheck/ignore.d.server/common.local
@@ -1,6 +1,8 @@
# Ansible Managed
# Do NOT edit this file directly!
#
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: subsystem request for sftp by user [^[:space:]]+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/master\[[[:digit:]]+\]: reload -- version
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ (; ENV=([_a-zA-Z]+=\S* )+)?; COMMAND=(/(usr|etc|bin|sbin)/|sudoedit )
# Ansible logs everything into syslog
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-[a-z]+: Invoked
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-([a-z]+|<stdin>): Invoked with
diff --git a/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo b/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo
new file mode 100644
index 0000000..e474019
--- /dev/null
+++ b/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo
@@ -0,0 +1,7 @@
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sudo: pam_krb5\(sudo:auth\): user [[:alnum:]-]+ authenticated as [[:alnum:]-]+@[.A-Z]+$
+# ignore sudo with custom ENV
+#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|console|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ ; COMMAND=((/(usr|etc|bin|sbin)/|sudoedit ).*|list)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|console|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ (; ENV=([_a-zA-Z]+=\S* )+)?; COMMAND=((/(usr|etc|bin|sbin)/|sudoedit ).*|list)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : \(command continued\).*$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo: pam_[[:alnum:]]+\(sudo:session\): session opened for user [[:alnum:]-]+ by ([[:alnum:]-]+)?\(uid=[0-9]+\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo: pam_[[:alnum:]]+\(sudo:session\): session closed for user [[:alnum:]-]+$
diff --git a/roles/common/tasks/logging.yml b/roles/common/tasks/logging.yml
index 06f06b0..d25a75e 100644
--- a/roles/common/tasks/logging.yml
+++ b/roles/common/tasks/logging.yml
@@ -20,6 +20,7 @@
with_items:
- logcheck.conf
- ignore.d.server/common.local
+ - violations.ignore.d/logcheck-sudo
- name: Minimal logging policy (1)
lineinfile: dest=/etc/logrotate.d/rsyslog
diff --git a/roles/common/tasks/rkhunter.yml b/roles/common/tasks/rkhunter.yml
index f6a4d71..78eec90 100644
--- a/roles/common/tasks/rkhunter.yml
+++ b/roles/common/tasks/rkhunter.yml
@@ -8,6 +8,8 @@
- unhide
- unhide.rb
+# To test the configuration:
+# ansible all -m command -a '/usr/bin/rkhunter -c --nomow --rwo'
- name: Configure rkhunter
copy: src=etc/{{ item }}
dest=/etc/{{ item }}
diff --git a/roles/common/tasks/sysctl.yml b/roles/common/tasks/sysctl.yml
index 9adeece..6ac7feb 100644
--- a/roles/common/tasks/sysctl.yml
+++ b/roles/common/tasks/sysctl.yml
@@ -1,4 +1,4 @@
-- sysctl: name={{ item.name }} value={{ item.value }}
+- sysctl: name={{ item.name }} "value={{ item.value }}" sysctl_set=yes
with_items:
- { name: 'kernel.domainname', value: '{{ ansible_domain }}' }