summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/bacula-dir/tasks/main.yml2
-rw-r--r--roles/common-SQL/files/etc/mysql/my.cnf1
-rw-r--r--roles/common-SQL/tasks/main.yml14
-rw-r--r--roles/common/files/etc/logcheck/ignore.d.server/common-local2
-rw-r--r--roles/lists/tasks/sympa.yml6
5 files changed, 9 insertions, 16 deletions
diff --git a/roles/bacula-dir/tasks/main.yml b/roles/bacula-dir/tasks/main.yml
index 5a23dc5..4cacc6e 100644
--- a/roles/bacula-dir/tasks/main.yml
+++ b/roles/bacula-dir/tasks/main.yml
@@ -1,28 +1,28 @@
- name: Install bacula-director
apt: pkg={{ item }}
with_items:
- bacula-console
- bacula-director-mysql
- name: Create a 'bacula' SQL user
- mysql_user2: name=bacula password= auth_plugin=auth_socket
+ mysql_user2: name=bacula password= auth_plugin=unix_socket
state=present
notify:
- Restart bacula-director
# Create with:
# echo bconsole $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
# echo $sd-sd $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
# echo $fd-fd $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
#
# then add the password for each FD / SD:
# echo $director-dir $password | sudo tee /etc/bacula/passwords-sd
# echo $director-dir $password | sudo tee /etc/bacula/passwords-fd
- name: Ensure /etc/bacula/passwords-dir exists
file: path=/etc/bacula/passwords-dir
state=file
owner=bacula group=bacula
mode=0600
- name: Configure bconsole
template: src=etc/bacula/bconsole.conf.j2
diff --git a/roles/common-SQL/files/etc/mysql/my.cnf b/roles/common-SQL/files/etc/mysql/my.cnf
index 6caeb64..e1dff58 100644
--- a/roles/common-SQL/files/etc/mysql/my.cnf
+++ b/roles/common-SQL/files/etc/mysql/my.cnf
@@ -18,41 +18,40 @@
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
[client]
port = 3306
socket = /var/run/mysqld/mysqld.sock
# Here is entries for some specific programs
# The following values assume you have at least 32M ram
# This was formally known as [safe_mysqld]. Both versions are currently parsed.
[mysqld_safe]
socket = /var/run/mysqld/mysqld.sock
nice = 0
[mysqld]
#
# * Basic Settings
#
user = mysql
pid-file = /var/run/mysqld/mysqld.pid
socket = /var/run/mysqld/mysqld.sock
-plugin-load = auth_socket=auth_socket.so
port = 3306
basedir = /usr
datadir = /var/lib/mysql
tmpdir = /tmp
lc-messages-dir = /usr/share/mysql
character_set_server = utf8
collation_server = utf8_unicode_ci
skip-external-locking
#
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address = 127.0.0.1
skip-networking
#
# * Fine Tuning
#
key_buffer_size = 16M
max_allowed_packet = 16M
thread_stack = 192K
thread_cache_size = 8
diff --git a/roles/common-SQL/tasks/main.yml b/roles/common-SQL/tasks/main.yml
index 9064a68..73b6878 100644
--- a/roles/common-SQL/tasks/main.yml
+++ b/roles/common-SQL/tasks/main.yml
@@ -1,51 +1,45 @@
-# XXX If #742046 gets fixed, we should preseed mysql-server to use
-# auth_socket as auth_plugin once the fix enters stable.
-- name: Install MySQL
+- name: Install MariaDB
apt: pkg={{ item }}
with_items:
- # XXX: In non-interactive mode apt-get doesn't put a password on
- # MySQL's root user; we fix that on the next task, but an intruder
- # could exploit the race condition and for instance create dummy
- # users.
- - mysql-common
- - mysql-server
+ - mariadb-common
+ - mariadb-server
- python-mysqldb
# for the 'mysql_' munin plugin
- libcache-cache-perl
- name: Copy MySQL's configuration
copy: src=etc/mysql/my.cnf
dest=/etc/mysql/my.cnf
owner=root group=root
mode=0644
register: r
notify:
- Restart MySQL
# We need to restart now and load the relevant authplugin before we
# connect to the database.
- meta: flush_handlers
# XXX Dirty fix for #742046
- name: Force root to use UNIX permissions
- mysql_user2: name=root password= auth_plugin=auth_socket
+ mysql_user2: name=root password= auth_plugin=unix_socket soname=auth_socket.so
state=present
- name: Disallow anonymous and TCP/IP root login
mysql_user2: name={{ item.name|default('') }} host={{ item.host }}
state=absent
with_items:
- { host: '{{ inventory_hostname_short }}' }
- { host: 'localhost' }
- { host: '127.0.0.1'}
- { host: '::1'}
- { name: root, host: '{{ inventory_hostname_short }}' }
- { name: root, host: '127.0.0.1'}
- { name: root, host: '::1'}
- name: Start MySQL
service: name=mysql state=started
- name: Install 'mysql_' Munin wildcard plugin
file: src=/usr/share/munin/plugins/mysql_
diff --git a/roles/common/files/etc/logcheck/ignore.d.server/common-local b/roles/common/files/etc/logcheck/ignore.d.server/common-local
index c2a8d7f..c798120 100644
--- a/roles/common/files/etc/logcheck/ignore.d.server/common-local
+++ b/roles/common/files/etc/logcheck/ignore.d.server/common-local
@@ -16,27 +16,27 @@
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Accepted publickey for [^[:space:]]+ from [^[:space:]]+ port [[:digit:]]+( (ssh|ssh2))?(: (DSA|RSA|ECDSA|ED25519) ([[:xdigit:]]{2}:){15}[[:xdigit:]]{2})?$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: WARNING: no suitable primes in /etc/ssh/primes$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[1\]: Start(ing|ed) Cleanup of Temporary Directories\.(\.\.)?$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ slapd\[[[:digit:]]+\]: connection_input: conn=[[:digit:]]+ deferring operation: binding$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (slapd\[[[:digit:]]+\]|slap(acl|add|auth|cat|dn|index)|ldap(add|compare|delete|exop|modify|modrdn|passwd|search|url|whoami)): DIGEST-MD5 common mech free$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ (; ENV=([_a-zA-Z]+=\S* )+)?; COMMAND=(/(usr|etc|bin|sbin)/|sudoedit )
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: bytecode\.(cld|cvd) (is up to date|updated) \(version: [[:digit:]]+, sigs: [[:digit:]]+, f-level: [[:digit:]]+, builder: [._[:alnum:]-]+\)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: Your ClamAV installation is OUTDATED!$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: Local version: [[:digit:]]+(\.[[:digit:]]+)* Recommended version: [[:digit:]]+(\.[[:digit:]]+)*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: getfile: [._[:alnum:]-]+ not found on remote server \(IP: [.[:digit:]]+\)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: WARNING: Incremental update failed, trying to download daily\.cvd$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: (WARNING|ERROR): (getpatch: )?Can't download [._[:alnum:]-]+ from [.[:alnum:]-]+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Trying host [.[:alnum:]-]+ \([.[:digit:]]+\)\.\.\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Trying again in [[:digit:]]+ secs\.\.\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Giving up on [.[:alnum:]-]+\.\.\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: Downloading [._[:alnum:]-]+ \[[[:digit:]]+%\]$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ freshclam\[[[:digit:]]+\]: DON'T PANIC! Read http://www\.clamav\.net/support/faq$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+ *\] Peer [.[:digit:]]+:[[:digit:]]+/[[:digit:]]+ unexpectedly shrunk window [[:digit:]]+:[[:digit:]]+ \(repaired\)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[.[:digit:]]+" x-pid="[[:digit:]]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rsyslogd-?([[:digit:]]+): action '[^']+' (resumed \(module '[.[:alnum:]-]+:[.[:alnum:]-]+'\)|suspended, next retry is \w{3} \w{3} [ :[:digit:]]{16}) \[try http://www\.rsyslog\.com/e/\1 \]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-([_a-z]+|<stdin>): Invoked with
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-([_a-z0-9]+|<stdin>): Invoked with
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (sympa\((command|distribute)\)|wwsympa|archived|bounced|bulk|task_manager)\[[[:digit:]]+\]: (info|notice)\s
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wwsympa\[[[:digit:]]+\]: err .* main::check_action_parameters\(\) user not logged in$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rrdcached\[[[:digit:]]+\]: (flushing old values|rotating journals|started new journal /\S+$|removing old journal /\S+$)
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rrdcached\[[[:digit:]]+\]: queue_thread_main: rrd_update_r \(([^)]+)\) failed with status -1. \(opening '\1': No such file or directory\)
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: Audit daemon rotating log files$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ stunnel(:|4\[[[:digit:]]+\]: [0-9]{4}\.[0-9]{2}\.[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}) LOG3\[[[:digit:]]+\]: SSL_accept: (Peer suddenly disconnected|[[:xdigit:]]+: error:[[:xdigit:]]+:SSL routines:SSL2?3_GET_CLIENT_HELLO:(unknown protocol|http request|no shared cipher))$
diff --git a/roles/lists/tasks/sympa.yml b/roles/lists/tasks/sympa.yml
index 4aaa2c9..0496c55 100644
--- a/roles/lists/tasks/sympa.yml
+++ b/roles/lists/tasks/sympa.yml
@@ -1,32 +1,32 @@
- apt: pkg={{ item }} install_recommends=no
with_items:
- - mysql-server
+ - mariadb-server
- sympa
- libnet-dns-perl
- libnet-dns-sec-perl
- libmail-dkim-perl
- libcrypt-smime-perl
- libcrypt-openssl-x509-perl
-- name: Make the 'sympa' MySQL user use auth_socket
- mysql_user2: name=sympa password= auth_plugin=auth_socket
+- name: Make the 'sympa' MySQL user use unix_socket
+ mysql_user2: name=sympa password= auth_plugin=unix_socket
state=present
# XXX We want to change the retun-path for sendpasswd notices from
# 'sympa-request@$robot' to 'noreply@fripost.org'.
# * /usr/lib/cgi-bin/sympa/wwsympa.fcgi
# do_requestpasswd, do_subrequest: add $param->{'return_path'}='noreply@fripost.org';
# * List::send_global_file
# $data->{'return_path'} //= &Conf::get_robot_conf($robot, 'request');
# See #787946.
- name: Configure Sympa
copy: src=etc/sympa/{{ item }}
dest=/etc/sympa/{{ item }}
owner=root group=sympa
mode=0644
with_items:
- sympa.conf
- wwsympa.conf
- topics.conf
register: r1
notify:
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-25 08:35:18 +0000