diff options
Diffstat (limited to 'roles/common')
| -rw-r--r-- | roles/common/files/etc/logcheck/ignore.d.server/common-local | 2 | ||||
| -rw-r--r-- | roles/common/files/lib/systemd/system/stunnel4.service | 14 | ||||
| -rw-r--r-- | roles/common/files/lib/systemd/system/stunnel4@.service | 23 | ||||
| -rw-r--r-- | roles/common/handlers/main.yml | 7 | ||||
| -rw-r--r-- | roles/common/tasks/bacula.yml | 29 | ||||
| -rw-r--r-- | roles/common/tasks/main.yml | 8 | ||||
| -rw-r--r-- | roles/common/tasks/munin-node-ssl.yml | 58 | ||||
| -rw-r--r-- | roles/common/tasks/munin-node.yml | 68 | ||||
| -rw-r--r-- | roles/common/tasks/stunnel.yml | 20 | ||||
| -rw-r--r-- | roles/common/templates/etc/stunnel/bacula-fd.conf.j2 | 3 | ||||
| -rw-r--r-- | roles/common/templates/etc/stunnel/munin-node.conf.j2 | 3 |
11 files changed, 145 insertions, 90 deletions
diff --git a/roles/common/files/etc/logcheck/ignore.d.server/common-local b/roles/common/files/etc/logcheck/ignore.d.server/common-local index 32bb906..8e654da 100644 --- a/roles/common/files/etc/logcheck/ignore.d.server/common-local +++ b/roles/common/files/etc/logcheck/ignore.d.server/common-local @@ -20,21 +20,21 @@ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ (; ENV=([_a-zA-Z]+=\S* )+)?; COMMAND=(/(usr|etc|bin|sbin)/|sudoedit ) ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: bytecode\.(cld|cvd) (is up to date|updated) \(version: [[:digit:]]+, sigs: [[:digit:]]+, f-level: [[:digit:]]+, builder: [._[:alnum:]-]+\)$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: Your ClamAV installation is OUTDATED!$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: Local version: [[:digit:]]+(\.[[:digit:]]+)* Recommended version: [[:digit:]]+(\.[[:digit:]]+)*$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: getfile: [._[:alnum:]-]+ not found on remote server \(IP: [.[:digit:]]+\)$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: Incremental update failed, trying to download daily\.cvd$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: (WARNING|ERROR): (getpatch: )?Can't download [._[:alnum:]-]+ from [.[:alnum:]-]+$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Trying host [.[:alnum:]-]+ \([.[:digit:]]+\)\.\.\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Trying again in [[:digit:]]+ secs\.\.\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Giving up on [.[:alnum:]-]+\.\.\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Downloading [._[:alnum:]-]+ \[[[:digit:]]+%\]$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: DON'T PANIC! Read http://www\.clamav\.net/support/faq$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+ *\] Peer [.[:digit:]]+:[[:digit:]]+/[[:digit:]]+ unexpectedly shrunk window [[:digit:]]+:[[:digit:]]+ \(repaired\)$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[.[:digit:]]+" x-pid="[[:digit:]]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rsyslogd-?([[:digit:]]+): action '[^']+' (resumed \(module '[.[:alnum:]-]+:[.[:alnum:]-]+'\)|suspended, next retry is \w{3} \w{3} [ :[:digit:]]{16}) \[try http://www\.rsyslog\.com/e/\1 \]$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-([_a-z]+|<stdin>): Invoked with ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (sympa\((command|distribute)\)|wwsympa|archived|bounced|bulk|task_manager)\[[[:digit:]]+\]: (info|notice)\s ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wwsympa\[[[:digit:]]+\]: err .* main::check_action_parameters\(\) user not logged in$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rrdcached\[[[:digit:]]+\]: (flushing old values|rotating journals|started new journal /\S+$|removing old journal /\S+$) ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rrdcached\[[[:digit:]]+\]: queue_thread_main: rrd_update_r \(([^)]+)\) failed with status -1. \(opening '\1': No such file or directory\) -^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ stunnel: LOG3\[[[:digit:]]+\]: SSL_accept: (Peer suddenly disconnected|[[:xdigit:]]+: error:[[:xdigit:]]+:SSL routines:SSL2?3_GET_CLIENT_HELLO:(unknown protocol|http request|no shared cipher))$ +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ stunnel(:|4\[[[:digit:]]+\]: [0-9]{4}\.[0-9]{2}\.[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}) LOG3\[[[:digit:]]+\]: SSL_accept: (Peer suddenly disconnected|[[:xdigit:]]+: error:[[:xdigit:]]+:SSL routines:SSL2?3_GET_CLIENT_HELLO:(unknown protocol|http request|no shared cipher))$ diff --git a/roles/common/files/lib/systemd/system/stunnel4.service b/roles/common/files/lib/systemd/system/stunnel4.service new file mode 100644 index 0000000..990e07b --- /dev/null +++ b/roles/common/files/lib/systemd/system/stunnel4.service @@ -0,0 +1,14 @@ +# This service is actually a systemd target, +# but we are using a service since targets cannot be reloaded. + +[Unit] +Description=SSL tunnel for network daemons (multi-instance-master) + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/bin/true +ExecReload=/bin/true + +[Install] +WantedBy=multi-user.target diff --git a/roles/common/files/lib/systemd/system/stunnel4@.service b/roles/common/files/lib/systemd/system/stunnel4@.service new file mode 100644 index 0000000..e53d29e --- /dev/null +++ b/roles/common/files/lib/systemd/system/stunnel4@.service @@ -0,0 +1,23 @@ +[Unit] +Description=SSL tunnel for network daemons (instance %i) +After=network.target nss-lookup.target +PartOf=stunnel4.service +ReloadPropagatedFrom=stunnel4.service + +[Service] +ExecStart=/usr/bin/stunnel4 /etc/stunnel/%i.conf +ExecReload=/bin/kill -HUP ${MAINPID} +KillSignal=SIGINT +TimeoutStartSec=120 +TimeoutStopSec=60 +Restart=on-failure + +# Hardening +NoNewPrivileges=yes +PrivateDevices=yes +ProtectHome=yes +ProtectSystem=full +ReadOnlyDirectories=/ + +[Install] +WantedBy=multi-user.target diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml index 47e3db8..ebb40a0 100644 --- a/roles/common/handlers/main.yml +++ b/roles/common/handlers/main.yml @@ -21,31 +21,34 @@ service: name=fail2ban state=restarted - name: Reload networking # /etc/init.d/networking doesn't answer the status command; but since # it should be "up" whenever ansible has access to the machine, we use # pattern=init as a dummy assumption. service: name=networking pattern=init state=reloaded - name: Restart rsyslog service: name=rsyslog state=restarted - name: Restart ntp service: name=ntp state=restarted - name: Restart Postfix service: name=postfix state=restarted - name: Reload Postfix service: name=postfix state=reloaded -- name: Restart stunnel - service: name=stunnel4 pattern=/usr/bin/stunnel4 state=restarted +- name: Restart stunnel@bacula-fd + service: name=stunnel4@bacula-fd state=restarted + +- name: Restart stunnel@munin-node + service: name=stunnel4@munin-node state=restarted - name: Restart bacula-fd service: name=bacula-fd state=restarted - name: Restart munin-node service: name=munin-node state=restarted - name: Restart freshclam service: name=clamav-freshclam state=restarted diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml index e29f01c..f0919e4 100644 --- a/roles/common/tasks/bacula.yml +++ b/roles/common/tasks/bacula.yml @@ -1,93 +1,88 @@ -- name: Install stunnel - apt: pkg=stunnel4 - -- name: Auto-enable stunnel - lineinfile: dest=/etc/default/stunnel4 - regexp='^(\s*#)?\s*ENABLED=' - line='ENABLED=1' - owner=root group=root - mode=0644 - - name: Create /etc/stunnel/certs file: path=/etc/stunnel/certs state=directory owner=root group=root mode=0755 - name: Generate a private key and a X.509 certificate for Bacula FD command: genkeypair.sh x509 --pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem --privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.key --ou=BaculaFD --cn={{ inventory_hostname }} --dns={{ inventory_hostname }} -t rsa -b 4096 -h sha512 register: r1 changed_when: r1.rc == 0 failed_when: r1.rc > 1 notify: - - Restart stunnel + - Restart stunnel@bacula-fd tags: - genkey - name: Fetch Bacula FD X.509 certificate # Ensure we don't fetch private data become: False fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem dest=certs/bacula/ fail_on_missing=yes flat=yes tags: - genkey - name: Copy Bacula Dir X.509 certificates assemble: src=certs/bacula regexp="-dir\.pem$" remote_src=no dest=/etc/stunnel/certs/bacula-dirs.pem owner=root group=root mode=0644 register: r2 when: "'bacula-dir' not in group_names" notify: - - Restart stunnel + - Restart stunnel@bacula-fd - name: Copy Bacula SD X.509 certificates copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem dest=/etc/stunnel/certs/ owner=root group=root mode=0644 register: r3 with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) }}" notify: - - Restart stunnel + - Restart stunnel@bacula-fd - name: Configure stunnel template: src=etc/stunnel/bacula-fd.conf.j2 dest=/etc/stunnel/bacula-fd.conf owner=root group=root mode=0644 register: r4 when: "'bacula-dir' not in group_names or 'bacula-sd' not in group_names" notify: - - Restart stunnel + - Restart stunnel@bacula-fd + +- name: Enable stunnel@bacula-fd + when: "'bacula-dir' not in group_names or 'bacula-sd' not in group_names" + service: name=stunnel4@bacula-fd enabled=yes -- name: Start stunnel - service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started - when: not (r1.changed or r2.changed or r3.changed or r4.changed) +- name: Start stunnel@bacula-fd + service: name=stunnel4@bacula-fd state=started + when: ('bacula-dir' not in group_names or 'bacula-sd' not in group_names) and + not (r1.changed or r2.changed or r3.changed or r4.changed) - meta: flush_handlers - name: Install bacula-fd apt: pkg=bacula-fd - name: Create /var/lib/bacula/tmp file: path=/var/lib/bacula/tmp state=directory owner=root group=root mode=0700 - name: Delete /etc/bacula/common_default_passwords file: path=/etc/bacula/common_default_passwords state=absent # Create with: # echo $director-dir $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-fd - name: Ensure /etc/bacula/passwords-fd exists diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 3e6a4a8..14cb7ae 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -1,34 +1,37 @@ --- - include: sysctl.yml tags: sysctl - include: hosts.yml - include: apt.yml tags: apt - name: Install intel-microcode apt: pkg=intel-microcode when: "ansible_processor[0] | search('^(Genuine)?Intel.*') and not (ansible_virtualization_role == 'guest' and ansible_virtualization_type == 'xen')" tags: intel - include: firewall.yml tags: - firewall - iptables + +- include: stunnel.yml + tags: stunnel - include: samhain.yml tags: samhain - include: auditd.yml tags: auditd - include: rkhunter.yml tags: rkhunter - include: clamav.yml tags: clamav - include: fail2ban.yml tags: fail2ban - include: smart.yml tags: - smartmontools - smart when: "not ((ansible_virtualization_role == 'guest' and ansible_virtualization_type == 'xen') or ansible_system_vendor == 'QEMU')" - include: haveged.yml tags: - haveged - entropy - name: Copy genkeypair.sh and gendhparam.sh @@ -42,33 +45,38 @@ - gendhparam.sh - name: Generate DH parameters command: gendhparam.sh /etc/ssl/private/dhparams.pem creates=/etc/ssl/private/dhparams.pem tags: genkey - include: logging.yml tags: logging - include: ntp.yml tags: ntp - include: mail.yml tags: - mail - postfix - include: bacula.yml tags: - bacula-fd - bacula - include: munin-node.yml tags: - munin-node - munin +- include: munin-node-ssl.yml + when: "'munin-master' not in group_names" + tags: + - munin-node + - munin - name: Install common packages apt: pkg={{ item }} with_items: - ca-certificates - etckeeper - ethtool - git - htop - molly-guard - rsync - screen - telnet-ssl diff --git a/roles/common/tasks/munin-node-ssl.yml b/roles/common/tasks/munin-node-ssl.yml new file mode 100644 index 0000000..59ed7d7 --- /dev/null +++ b/roles/common/tasks/munin-node-ssl.yml @@ -0,0 +1,58 @@ +- name: Create /etc/stunnel/certs + file: path=/etc/stunnel/certs + state=directory + owner=root group=root + mode=0755 + +- name: Generate a private key and a X.509 certificate for munin-node + command: genkeypair.sh x509 + --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem + --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key + --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }} + -t rsa -b 4096 -h sha512 + register: r1 + changed_when: r1.rc == 0 + failed_when: r1.rc > 1 + notify: + - Restart stunnel@munin-node + tags: + - genkey + +- name: Fetch Munin X.509 certificate + # Ensure we don't fetch private data + become: False + fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem + dest=certs/munin/{{ inventory_hostname }}.pem + fail_on_missing=yes + flat=yes + tags: + - genkey + +- name: Copy munin-master X.509 certificates + assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no + dest=/etc/stunnel/certs/munin-master.pem + owner=root group=root + mode=0644 + register: r2 + when: "'munin-master' not in group_names" + notify: + - Restart stunnel@munin-node + +- name: Configure stunnel + template: src=etc/stunnel/munin-node.conf.j2 + dest=/etc/stunnel/munin-node.conf + owner=root group=root + mode=0644 + register: r3 + when: "'munin-master' not in group_names" + notify: + - Restart stunnel@munin-node + +- name: Enable stunnel@munin-node + service: name=stunnel4@munin-node enabled=yes + +- name: Start stunnel@munin-node + service: name=stunnel4@munin-node state=started + when: not (r1.changed or r2.changed or r3.changed) + +- meta: flush_handlers diff --git a/roles/common/tasks/munin-node.yml b/roles/common/tasks/munin-node.yml index c585d60..e1a931a 100644 --- a/roles/common/tasks/munin-node.yml +++ b/roles/common/tasks/munin-node.yml @@ -120,88 +120,20 @@ - Restart munin-node - name: Install 'postfix_stats_' Munin wildcard plugin file: src=/usr/local/share/munin/plugins/postfix_stats_ dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix owner=root group=root state=link force=yes register: r7 with_items: - smtpd - qmgr - smtp notify: - Restart munin-node - name: Start munin-node service: name=munin-node state=started when: not (r1.changed or r2.changed or r3.changed or r4.changed or r5.changed or r6.changed or r7.changed) - meta: flush_handlers - - - -- name: Install stunnel - apt: pkg=stunnel4 - -- name: Auto-enable stunnel - lineinfile: dest=/etc/default/stunnel4 - regexp='^(\s*#)?\s*ENABLED=' - line='ENABLED=1' - owner=root group=root - mode=0644 - -- name: Create /etc/stunnel/certs - file: path=/etc/stunnel/certs - state=directory - owner=root group=root - mode=0755 - -- name: Generate a private key and a X.509 certificate for munin-node - command: genkeypair.sh x509 - --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem - --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key - --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }} - -t rsa -b 4096 -h sha512 - register: r1 - changed_when: r1.rc == 0 - failed_when: r1.rc > 1 - notify: - - Restart stunnel - tags: - - genkey - -- name: Fetch Munin X.509 certificate - # Ensure we don't fetch private data - become: False - fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem - dest=certs/munin/{{ inventory_hostname }}.pem - fail_on_missing=yes - flat=yes - tags: - - genkey - -- name: Copy munin-master X.509 certificates - assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no - dest=/etc/stunnel/certs/munin-master.pem - owner=root group=root - mode=0644 - register: r2 - when: "'munin-master' not in group_names" - notify: - - Restart stunnel - -- name: Configure stunnel - template: src=etc/stunnel/munin-node.conf.j2 - dest=/etc/stunnel/munin-node.conf - owner=root group=root - mode=0644 - register: r3 - when: "'munin-master' not in group_names" - notify: - - Restart stunnel - -- name: Start stunnel - service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started - when: not (r1.changed or r2.changed or r3.changed) - -- meta: flush_handlers diff --git a/roles/common/tasks/stunnel.yml b/roles/common/tasks/stunnel.yml new file mode 100644 index 0000000..68469cd --- /dev/null +++ b/roles/common/tasks/stunnel.yml @@ -0,0 +1,20 @@ +- name: Install stunnel4 + apt: pkg=stunnel4 + +- name: Set 'ENABLED=0' in /etc/default/stunnel4 + lineinfile: dest=/etc/default/stunnel4 + regexp='^(\s*#)?\s*ENABLED=' + line='ENABLED=0' + owner=root group=root + mode=0644 + +- name: Copy stunnel4 service file + copy: src=lib/systemd/system/{{ item }} + dest=/lib/systemd/system/{{ item }} + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + with_items: + - stunnel4.service + - stunnel4@.service diff --git a/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 b/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 index ed819c0..851f0ac 100644 --- a/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 +++ b/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 @@ -1,30 +1,31 @@ ; ************************************************************************** ; * Global options * ; ************************************************************************** ; setuid()/setgid() to the specified user/group in daemon mode setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail -pid = /var/run/stunnel4/bacula-fd.pid +pid = +foreground = yes ; Only log messages at severity warning (4) and higher debug = 4 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem key = /etc/stunnel/certs/{{ inventory_hostname_short }}-fd.key ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Prevent MITM attacks verify = 4 ; Disable support for insecure protocols diff --git a/roles/common/templates/etc/stunnel/munin-node.conf.j2 b/roles/common/templates/etc/stunnel/munin-node.conf.j2 index 83614b5..229def0 100644 --- a/roles/common/templates/etc/stunnel/munin-node.conf.j2 +++ b/roles/common/templates/etc/stunnel/munin-node.conf.j2 @@ -1,30 +1,31 @@ ; ************************************************************************** ; * Global options * ; ************************************************************************** ; setuid()/setgid() to the specified user/group in daemon mode setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail -pid = /var/run/stunnel4/munin-node.pid +pid = +foreground = yes ; Only log messages at severity warning (4) and higher debug = 4 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem key = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Prevent MITM attacks verify = 4 ; Disable support for insecure protocols |