summaryrefslogtreecommitdiffstats
path: root/roles/common/files
Commit message (Collapse)AuthorAgeFiles
* Port baseline to Debian 11 (codename Bullseye).Guilhem Moulin2022-10-1310
|
* logcheck-database update.Guilhem Moulin2022-10-113
|
* logcheck-database update.Guilhem Moulin2021-02-131
| | | | ansible 2.10.7 uses "ansible-ansible.legacy.stat: Invoked with […]".
* rkhunter: workaround for mix usrmerge/non-usrmerge environments.Guilhem Moulin2020-11-151
| | | | See https://bugs.debian.org/932594#15 .
* logcheck-database update.Guilhem Moulin2020-11-154
|
* Bacula: refactor systemd service files.Guilhem Moulin2020-11-031
| | | | | | Use unit overrides on top of upstream's service files instead of overriding entire service files. In particular, upstream uses flag `-P` so we don't need to use RuntimeDirectory= anymore.
* IMAP: Update role to Debian Buster.Guilhem Moulin2020-05-191
| | | | | | | | For `ssl_cipher_list` we pick the suggested value from https://ssl-config.mozilla.org/#server=dovecot&version=2.3.9&config=intermediate&openssl=1.1.1d At the moment it's equivalent (modulo order) to adding ‘EDH+AESGCM+aRSA’ to ‘EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL’.
* stunnel4: Harden and socket-activate.Guilhem Moulin2020-05-181
|
* Upgrade baseline to Debian 10.Guilhem Moulin2020-05-1611
|
* Improve/harden fail2ban configuration.Guilhem Moulin2020-01-255
| | | | | | | | | * Use nftables sets with a timeout * Start daemon with a hardened unit file and restricted Capability Bounding Set. (This requires to change the log path to /var/log/fail2ban/*.) * Skip database as we don't care about persistence. * Refactor jail.local
* Convert firewall to nftables.Guilhem Moulin2020-01-234
| | | | Debian Buster uses the nftables framework by default.
* MSA: Open 465/TCP for Email Submission over TLS.Guilhem Moulin2019-03-191
| | | | See RFC 8314 sec. 3.3 "Cleartext Considered Obsolete".
* firewall: gracefully close invalid connections.Guilhem Moulin2018-12-221
| | | | | | | This is useful when an ESTABLISHED connection is seen as NEW because the client was offline for some time. For instance, clients now gracefully close existing SSH connections immediately after resuming from a suspend state, rather that waiting for the TCP timeout.
* Update 'IMAP', 'MSA' and 'LDAP-provider' roles to Debian Stretch.Guilhem Moulin2018-12-093
|
* Disable resume device.Guilhem Moulin2018-12-091
| | | | We don't need suspend-on-disk (hibernation).
* systemd.service: Tighten hardening options.Guilhem Moulin2018-12-092
|
* bacula-*.service: Don't fork in the background.Guilhem Moulin2018-12-091
| | | | Inspired from /lib/systemd/system/bacula-fd.service.
* Upgrade 'lists' role to Debian Stretch.Guilhem Moulin2018-12-091
|
* systemd: Replace ‘ProtectSystem=full’ with ‘ProtectSystem=strict’.Guilhem Moulin2018-12-092
| | | | And remove ‘ReadOnlyDirectories=/’ as it's implied by ‘ProtectSystem=strict’.
* Firewall: REJECT outgoing connections instead of DROPing them.Guilhem Moulin2018-12-091
|
* DKIM: also include the "d=" tag in key filenames, not only the "s=" tag.Guilhem Moulin2018-12-051
| | | | | While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily.
* Postfix: replace cdb & btree tables with lmdb ones.Guilhem Moulin2018-12-031
| | | | Cf. lmdb_table(5).
* IPsec: allow ISAKMP over IPv6.Guilhem Moulin2018-12-031
|
* Upgrade baseline to Debian Stretch.Guilhem Moulin2018-12-039
|
* Skip samhain installation.Guilhem Moulin2018-12-031
| | | | It's become too verbose (too many false-positive)…
* Harden anti spam on the MX:es.Guilhem Moulin2018-06-091
|
* More logcheck-database tweaks.Guilhem Moulin2018-04-043
|
* sympa: wibbleGuilhem Moulin2018-04-041
|
* Perform recipient address verification on the MSA itself.Guilhem Moulin2018-04-041
|
* More logcheck-database tweaks.Guilhem Moulin2017-09-143
|
* rkhunter: Disable remote updates to fix CVE-2017-7480.Guilhem Moulin2017-07-291
|
* Use MariaDB as default MySQL flavor.Guilhem Moulin2017-07-291
|
* More logcheck-database tweaks.Guilhem Moulin2017-06-071
|
* postfix-sender-login: wibbleGuilhem Moulin2017-06-051
|
* dovecot: enable user iteration and add a cronjob for `doveadm purge -A`Guilhem Moulin2017-06-051
|
* postfix: don't rate-limit our IPsec subnet.Guilhem Moulin2017-06-021
|
* /lib/systemd/system → /etc/systemd/systemGuilhem Moulin2017-05-313
|
* MSA: reject null sender address.Guilhem Moulin2017-05-141
|
* More logcheck-database tweaks.Guilhem Moulin2016-12-081
|
* Firewall: allow duplicates rules.Guilhem Moulin2016-09-181
|
* More logcheck-database tweaks.Guilhem Moulin2016-08-222
|
* Postfix: don't share the master.cf between the instances.Guilhem Moulin2016-07-101
|
* More logcheck-database tweaks.Guilhem Moulin2016-07-092
|
* IPSec → IPsecGuilhem Moulin2016-06-291
|
* More logcheck-database tweaks.Guilhem Moulin2016-06-293
|
* update-firewall.sh: COMMIT empty iptables rule files.Guilhem Moulin2016-06-291
|
* typoGuilhem Moulin2016-05-241
|
* IPSec: replace (self-signed) X.509 certs by their raw pubkey for authentication.Guilhem Moulin2016-05-241
| | | | There is no need to bother with X.509 cruft here.
* genkeypair, gendhparam: use -rand /dev/urandom when generating keys or DH ↵Guilhem Moulin2016-05-222
| | | | parameters.
* Tunnel bacula (dir → {fd,sd} and fd → sd) traffic through IPSec.Guilhem Moulin2016-05-221
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 09:00:05 +0000