Upgrade baseline to Debian 10.

6 files changed, 16 insertions, 7 deletions

diff --git a/roles/common/templates/etc/bacula/bacula-fd.conf.j2 b/roles/common/templates/etc/bacula/bacula-fd.conf.j2
index e06911f..db1960e 100644
--- a/roles/common/templates/etc/bacula/bacula-fd.conf.j2
+++ b/roles/common/templates/etc/bacula/bacula-fd.conf.j2
@@ -1,38 +1,39 @@
 #
 # Default  Bacula File Daemon Configuration file
 #
-#  For Bacula release 5.2.6 (21 February 2012) -- debian jessie/sid
+# For Bacula release 9.4.2 (04 February 2019) -- debian buster/sid
+#
 
 #
 # List Directors who are permitted to contact this File daemon
 #
 {% for dir in groups['bacula_dir'] | sort %}
 Director {
   Name = {{ hostvars[dir].inventory_hostname_short }}-dir
   @|"sed -n '/^{{ hostvars[dir].inventory_hostname_short }}-dir\\s/ {s//Password = /p; q}' /etc/bacula/passwords-fd"
 }
 
 # Send all messages except skipped files back to Director
 Messages {
   Name = Standard
   director = {{ hostvars[dir].inventory_hostname_short }}-dir = all, !skipped, !restored
 }
 {% endfor %}
 
 #
 # "Global" File daemon configuration specifications
 #
 FileDaemon {  # define myself
   Name = {{ inventory_hostname_short }}-fd
   Working Directory = /var/lib/bacula
-  Pid Directory = /var/run/bacula
+  Pid Directory = /run/bacula
   Maximum Concurrent Jobs = 20
   FDAddress = {{ ipsec[inventory_hostname_short] }}
   FDPort = 9102
   SDConnectTimeout = 5 min
 
   PKI Signatures = Yes  # Enable Data Signing
   PKI Encryption = Yes  # Enable Data Encryption
   PKI Keypair = /etc/bacula/ssl/{{ inventory_hostname_short }}.pem # Public and Private Keys
   PKI Master Key = /etc/bacula/ssl/master.pem                      # ONLY the Public Key
 }
diff --git a/roles/common/templates/etc/munin/munin-node.conf.j2 b/roles/common/templates/etc/munin/munin-node.conf.j2
index 1563526..a1391d9 100644
--- a/roles/common/templates/etc/munin/munin-node.conf.j2
+++ b/roles/common/templates/etc/munin/munin-node.conf.j2
@@ -1,27 +1,27 @@
 #
 # Example config-file for munin-node
 #
 
 log_level 4
 log_file /var/log/munin/munin-node.log
-pid_file /var/run/munin/munin-node.pid
+pid_file /run/munin/munin-node.pid
 
 background 1
 setsid 1
 
 user root
 group root
 
 # This is the timeout for the whole transaction.
 # Units are in sec. Default is 15 min
 #
 # global_timeout 900
 
 # This is the timeout for each plugin.
 # Units are in sec. Default is 1 min
 #
 # timeout 60
 
 # Regexps for files to ignore
 ignore_file [\#~]$
 ignore_file DEADJOE$
diff --git a/roles/common/templates/etc/munin/plugin-conf.d/munin-node.j2 b/roles/common/templates/etc/munin/plugin-conf.d/munin-node.j2
index 2d434bc..ec471eb 100644
--- a/roles/common/templates/etc/munin/plugin-conf.d/munin-node.j2
+++ b/roles/common/templates/etc/munin/plugin-conf.d/munin-node.j2
@@ -56,41 +56,41 @@ user root
 user root
 
 [hddtemp2]
 user root
 
 [if_*]
 user root
 
 [if_err_*]
 user nobody
 
 [ip_*]
 user root
 
 [ipmi_*]
 user root
 
 [mysql*]
 user root
 env.mysqlopts --defaults-file=/etc/mysql/debian.cnf
-env.mysqluser debian-sys-maint
+env.mysqluser root
 env.mysqlconnection DBI:mysql:mysql;mysql_read_default_file=/etc/mysql/debian.cnf
 
 [postfix_mailqueue_*]
 user postfix
 
 [postfix_stats_*]
 group adm
 
 [postfix_sasl_*]
 group adm
 
 [postfix_mailvolume2]
 group adm
 env.postmulti postfix{% for g in postfix_instance.keys() | sort %}{% if g in group_names %} postfix-{{ postfix_instance[g].name }}{% endif %}{% endfor %}
 
 
 [dovecot_logins]
 group adm
 
 [dovecot_stats_*]
diff --git a/roles/common/templates/etc/nftables.conf.j2 b/roles/common/templates/etc/nftables.conf.j2
index 1e1fde2..3d2a23d 100755
--- a/roles/common/templates/etc/nftables.conf.j2
+++ b/roles/common/templates/etc/nftables.conf.j2
@@ -69,76 +69,82 @@ table inet filter {
         icmpv6 type { echo-reply, echo-request, destination-unreachable,
                       packet-too-big, time-exceeded, parameter-problem } counter accept
 
         # accept neighbour discovery for autoconfiguration, RFC 4890 sec. 4.4.1
         icmpv6 type { 133,134,135,136,141,142 } ip6 hoplimit 255 counter accept
 
         jump martian
         jump invalid
 
         udp sport  123 udp dport  123 ct state     related,established accept
 {% if groups.all | length > 1 %}
         udp sport  500 udp dport  500 ct state new,related,established accept
 {% if groups.NATed | length > 0 %}
         udp sport 4500 udp dport 4500 ct state new,related,established accept
 {% endif %}
 {% endif %}
 
         udp sport 53 ct state related,established accept
         tcp sport 53 ct state related,established accept
 {% if 'dhclient' in group_names %}
-        udp sport 67 ct state related,established accept
+        ip  version 4 udp sport  67 udp dport  68 ct state related,established accept
+        ip6 version 6 udp sport 547 udp dport 546 ct state related,established accept
 {% endif %}
 
         meta l4proto tcp ip  saddr @fail2ban  counter drop
         meta l4proto tcp ip6 saddr @fail2ban6 counter drop
 
         tcp dport $in-tcp-ports  ct state related,established accept
         tcp dport $in-tcp-ports  ct state new counter accept
         tcp sport $out-tcp-ports ct state related,established accept
     }
 
     chain output {
         type filter hook output priority 0
         policy drop
 
         oif lo accept
 
         # XXX Bullseye: unlike for input we can't use marks here,
         # because by the time we see a packet to 172.16.0.0/24 we don't
         # know if it'll be encapsulated
         meta l4proto esp accept
         ip saddr 172.16.0.7 ip daddr 172.16.0.0/24 accept
 
         meta l4proto { icmp, icmpv6 } accept
 
         jump martian
         jump invalid
 
         udp sport  123 udp dport  123 ct state new,related,established accept
+{% if groups.all | length > 1 %}
         udp sport  500 udp dport  500 ct state new,related,established accept
+{% if groups.NATed | length > 0 %}
         udp sport 4500 udp dport 4500 ct state new,related,established accept
+{% endif %}
+{% endif %}
 
         udp dport 53 ct state new,related,established accept
         tcp dport 53 ct state new,related,established accept
 {% if 'dhclient' in group_names %}
-        udp dport 67 ct state new,related,established accept
+        ip  version 4 udp sport  68 udp dport  67 ct state new,related,established accept
+        ip6 version 6 udp sport 546 udp dport 547 ct state new,related,established accept
 {% endif %}
 
         tcp sport $in-tcp-ports  ct state related,established accept
         tcp dport $out-tcp-ports ct state related,established accept
         tcp dport $out-tcp-ports ct state new counter accept
 
         meta l4proto tcp counter reject with tcp reset
         meta l4proto udp counter reject
         counter reject
     }
 
     chain martian {
         # bogon filter (cf. RFC 6890 for non-global ip addresses)
         define invalid-ip = {
             0.0.0.0/8          # this host, on this network (RFC 1122 sec. 3.2.1.3)
 {% if not ansible_default_ipv4.address | ipaddr('10.0.0.0/8') %}
           , 10.0.0.0/8         # private-use (RFC 1918)
 {% endif %}
           , 100.64.0.0/10      # shared address space (RFC 6598)
           , 127.0.0.0/8        # loopback (RFC 1122, sec. 3.2.1.3)
diff --git a/roles/common/templates/etc/ntp.conf.j2 b/roles/common/templates/etc/ntp.conf.j2
index 18c03cf..1016d55 100644
--- a/roles/common/templates/etc/ntp.conf.j2
+++ b/roles/common/templates/etc/ntp.conf.j2
@@ -1,24 +1,26 @@
 # /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
 
 driftfile /var/lib/ntp/ntp.drift
 
+# Leap seconds definition provided by tzdata
+leapfile /usr/share/zoneinfo/leap-seconds.list
 
 # Enable this if you want statistics to be logged.
 #statsdir /var/log/ntpstats/
 
 statistics loopstats peerstats clockstats
 filegen loopstats file loopstats type day enable
 filegen peerstats file peerstats type day enable
 filegen clockstats file clockstats type day enable
 
 
 # You do need to talk to an NTP server or two (or three).
 {% if 'NTP_master' in group_names %}
 # Use Stratum One Time Servers:
 # http://support.ntp.org/bin/view/Servers/StratumOneTimeServers
 server sth1.ntp.se iburst
 server sth2.ntp.se iburst
 server gbg1.ntp.se iburst
 server gbg2.ntp.se iburst
 server ntp1.sp.se  iburst
 server ntp2.sp.se  iburst
diff --git a/roles/common/templates/etc/postfix/master.cf.j2 b/roles/common/templates/etc/postfix/master.cf.j2
index a9c73f7..2c00250 100644
--- a/roles/common/templates/etc/postfix/master.cf.j2
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -68,41 +68,41 @@ discard   unix  -       -       y       -       -       discard
 local     unix  -       n       n       -       -       local
 virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       y       -       -       lmtp
 anvil     unix  -       -       y       -       1       anvil
 scache    unix  -       -       y       -       1       scache
 {% if inst is defined and inst == 'MSA' %}
 policyd-spf unix -      n       n       -       0       spawn
     user=policyd-spf argv=/usr/bin/policyd-spf
 {% endif %}
 {% if inst is defined and inst == 'MX' %}
 reserved-alias unix  -  n       n       -       -       pipe
   flags=Rhu user=nobody argv=/usr/local/bin/reserved-alias.pl ${sender} ${original_recipient} @fripost.org
 {% endif %}
 {% if inst is defined and inst == 'lists' %}
 sympa     unix  -       n       n       -       -       pipe
   flags=Rhu user=sympa argv=/usr/local/bin/sympa-queue ${user}
 {% endif %}
 
 {% if inst is defined and inst == 'out' %}
 # Client part (lmtp) - amavis
-amavisfeed unix -       -       n       -       5       lmtp
+amavisfeed unix -       -       y       -       5       lmtp
   -o lmtp_destination_recipient_limit=1000
   -o lmtp_send_xforward_command=yes
   -o lmtp_data_done_timeout=1200s
   -o disable_dns_lookups=yes
 
 # Server part (smtpd) - amavis
 [127.0.0.1]:10025 inet n  -       y       -       -       smtpd
   -o content_filter=
   -o smtpd_delay_reject=no
   -o smtpd_client_restrictions=permit_mynetworks,reject
   -o smtpd_helo_restrictions=
   -o smtpd_sender_restrictions=
   -o smtpd_relay_restrictions=permit_mynetworks,reject
   -o smtpd_data_restrictions=reject_unauth_pipelining
   -o smtpd_end_of_data_restrictions=
   -o smtpd_restriction_classes=
   -o mynetworks_style=host
   -o smtpd_error_sleep_time=0
   -o smtpd_soft_error_limit=1001
   -o smtpd_hard_error_limit=1000