summaryrefslogtreecommitdiffstats
path: root/roles/common
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2013-10-30 20:56:45 +0100
committerGuilhem Moulin <guilhem@fripost.org>2015-06-07 02:49:33 +0200
commit4b3fd7e66dc1ed8b577cb522859d290b313b4ab1 (patch)
tree3e567e103da7da62ba4a43c5eccb218914c2c22c /roles/common
parente44838f8ef4a22ff6ee029ad907177e12ad2d2d4 (diff)
Basic ansible setup.
To run the playbook: cd ./ansible ansible-playbook -i vms site.yml
Diffstat (limited to 'roles/common')
-rw-r--r--roles/common/tasks/main.yml2
-rw-r--r--roles/common/tasks/sysctl.yml52
2 files changed, 54 insertions, 0 deletions
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
new file mode 100644
index 0000000..acc9611
--- /dev/null
+++ b/roles/common/tasks/main.yml
@@ -0,0 +1,2 @@
+---
+- include: sysctl.yml tags=sysctl
diff --git a/roles/common/tasks/sysctl.yml b/roles/common/tasks/sysctl.yml
new file mode 100644
index 0000000..4f52d3e
--- /dev/null
+++ b/roles/common/tasks/sysctl.yml
@@ -0,0 +1,52 @@
+- sysctl: name={{ item.name }} value={{ item.value }}
+ with_items:
+ - { name: 'kernel.domainname', value: '{{ ansible_domain }}' }
+
+ # Networking. See
+ # https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
+
+ # Enable Spoof protection (reverse-path filter). Turn on Source
+ # Address Verification in all interfaces to prevent some spoofing
+ # attacks.
+ - { name: 'net.ipv4.conf.default.rp_filter', value: 1 }
+ - { name: 'net.ipv4.conf.all.rp_filter', value: 1 }
+
+ # Enable TCP/IP SYN cookies to avoid TCP SYN flood attacks. We
+ # rate-limit not only the default ICMP types 3, 4, 11 and 12
+ # (0x1818), but also types 0 and 8. See icmp(7).
+ - { name: 'net.ipv4.tcp_syncookies', value: 1 }
+ - { name: 'net.ipv4.icmp_ratemask', value: 6425 }
+ - { name: 'net.ipv4.icmp_ratelimit', value: 1000 }
+
+ # Disable paquet forwarding between interfaces (we are not a router).
+ - { name: 'net.ipv4.ip_forward', value: 0 }
+ - { name: 'net.ipv6.conf.all.forwarding', value: 0 }
+
+ # Enable IPv6 Privacy Extensions.
+ - { name: 'net.ipv6.conf.default.use_tempaddr', value: 2 }
+ - { name: 'net.ipv6.conf.all.use_tempaddr', value: 2 }
+ - { name: 'net.ipv6.conf.all.autoconf', value: 0 }
+
+ # Do not accept ICMP redirects (prevent MITM attacks).
+ - { name: 'net.ipv4.conf.all.accept_redirects', value: 0 }
+ - { name: 'net.ipv6.conf.all.accept_redirects', value: 0 }
+
+ # Do not send ICMP redirects (we are not a router).
+ - { name: 'net.ipv4.conf.default.send_redirects', value: 0 }
+ - { name: 'net.ipv4.conf.all.send_redirects', value: 0 }
+
+ # Do not accept IP source route packets (we are not a router).
+ - { name: 'net.ipv4.conf.all.accept_source_route', value: 0 }
+ - { name: 'net.ipv6.conf.all.accept_source_route', value: 0 }
+
+ # Log Martian Packets.
+ - { name: 'net.ipv4.conf.all.log_martians', value: 1 }
+
+ # Ignore ICMP broadcasts.
+ - { name: 'net.ipv4.icmp_echo_ignore_broadcasts', value: 1 }
+
+ # Ignore bogus ICMP errors.
+ - { name: 'net.ipv4.icmp_ignore_bogus_error_responses', value: 1 }
+
+ # Enable connection tracking flow accounting.
+ - { name: 'net.netfilter.nf_conntrack_acct', value: 1 }