summaryrefslogtreecommitdiffstats
path: root/roles
Commit message (Collapse)AuthorAgeFiles
* Firewall: Harden IPsec configuration by pining the reqids.Guilhem Moulin2024-09-082
|
* OpenDMARC: Adjust configuration to bullseye.Guilhem Moulin2024-09-081
|
* Sympa: Default to dmarc_protection_mode=dmarc_reject.Guilhem Moulin2024-09-081
|
* Sympa: Update Content-Security-Policy.Guilhem Moulin2024-09-081
|
* APT: Prepare config bump to Debian 12.Guilhem Moulin2024-09-082
|
* logcheck-database update.Guilhem Moulin2024-09-082
|
* typofixGuilhem Moulin2024-09-081
|
* DKIM key generation: Adjust ownership.Guilhem Moulin2024-09-081
| | | | | As of bullseye amavis needs the private key material to be reabled by the 'amavis' user.
* MSA: Set smtpd_forbid_bare_newline to defeat SMTP smuggling attacks.Guilhem Moulin2024-09-081
|
* IMAP: Adjust dovecot configuration to bullseye.Guilhem Moulin2024-09-0812
| | | | | | | Provisioning /etc/dovecot/conf.d/*.conf is a pain on upgrade so we consolidate that by reverting these files to the distro-provided ones and shipping a single /etc/dovecot/conf.d/99-local.conf override instead.
* Roundcube: Set $config['max_recipients'] = 15 to avoid timeout.Guilhem Moulin2024-09-081
| | | | Cf. msgid=<ZFe5tjHTGbVemNTD@fripost.org>
* Don't take roundcube from backports.Guilhem Moulin2024-09-081
|
* Webmail: Upgrade backend to PHP7.4.Guilhem Moulin2024-09-084
|
* Sympa: Enable French support.Guilhem Moulin2024-06-121
| | | | Cf. msgid=<c368f04c-b8d1-4623-98f0-b6a3b724f90d@dubre.me>.
* Nextcloud: Set ‘X-Robots-Tag: noindex, nofollow’.Guilhem Moulin2023-03-261
| | | | Per upstream recommendation at https://cloud.fripost.org/settings/admin/overview .
* Sympa: Update robot.conf to fix HTTP 421 on virtual hosts.Guilhem Moulin2023-01-133
| | | | | | See https://github.com/sympa-community/sympa/issues/879 , https://www.sympa.community/manual/upgrade/notes.html#from-version-prior-to-6256 and https://www.sympa.community/gpldoc/man/sympa_config.5.html#wwsympa_url_local .
* Improve Debian 11's fail2ban rules.Guilhem Moulin2022-12-187
|
* Port baseline to Debian 11 (codename Bullseye).Guilhem Moulin2022-10-1323
|
* openldap module: Fix python3's bytes vs str mismatch.Guilhem Moulin2022-10-111
|
* Remove module ‘mysql_user2’.Guilhem Moulin2022-10-114
| | | | These days upstream's ‘mysql_user’ is good enough.
* Roundcube: managesieve: Disable ‘reject’ and ‘ereject’ extensions.Guilhem Moulin2022-10-111
|
* clamav-freshclam: Remove ‘SafeBrowsing’ option.Guilhem Moulin2022-10-111
|
* logcheck-database update.Guilhem Moulin2022-10-113
|
* postfix: Adjust anonymize_sender.pcre.Guilhem Moulin2022-10-111
|
* dovecot: Bump VSZ to 1G.Guilhem Moulin2022-10-111
|
* Prefix ‘ipaddr’ and ‘ipv4’ with ‘ansible.utils.’.Guilhem Moulin2022-10-1111
| | | | | | | This silences the following deprecation warning: Use 'ansible.utils.ipaddr' module instead. This feature will be removed from ansible.netcommon in a release after 2024-01-01. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
* Nextcloud: Adapt configuration to v21.Guilhem Moulin2021-05-232
|
* Rename '_lacme' user to '_lacme-client'.Guilhem Moulin2021-02-242
| | | | For a smooth upgrade to Bullseye's lacme 0.8-1.
* logcheck-database update.Guilhem Moulin2021-02-131
| | | | ansible 2.10.7 uses "ansible-ansible.legacy.stat: Invoked with […]".
* Don't restart amavis on DKIM key generation.Guilhem Moulin2021-02-131
| | | | | We want to give people the time add the key to DNS before we update the signing policy.
* munin: Skip ntp_* plugins when ntpq(1) is missing.Guilhem Moulin2021-02-061
|
* Roundcube: Fix favicon path.Guilhem Moulin2021-01-271
|
* Roundcube: Serve assets pre-compressed when possible.Guilhem Moulin2021-01-271
| | | | See https://salsa.debian.org/roundcube-team/roundcube/-/commit/f1e89494e8b777d69564e67f2d8b47ac84eb02f4 .
* Roundcube: Change document root to /var/lib/roundcube/public_html.Guilhem Moulin2021-01-271
| | | | Per https://salsa.debian.org/roundcube-team/roundcube/commit/7df02624eec4857053432d8ebe9b4e2b36f22bc5 .
* Postfix: pin key material to our MX:es for fripost.org and its subdomains.Guilhem Moulin2021-01-266
| | | | | | | | | | | | | | | | | | | | | | | | | | This solves an issue where an attacker would strip the STARTTLS keyword from the EHLO response, thereby preventing connection upgrade; or spoof DNS responses to route outgoing messages to an attacker-controlled SMTPd, thereby allowing message MiTM'ing. With key material pinning in place, smtp(8postfix) immediately aborts the connection (before the MAIL command) and places the message into the deferred queue instead: postfix-out/smtp[NNN]: … dsn=4.7.5, status=undeliverable (Server certificate not verified) This applies to the smarthost as well as for verification probes on the Mail Submission Agent. Placing message into the deferred queue might yield denial of service, but we argue that it's better than a privacy leak. This only covers *internal messages* (from Fripost to Fripost) though: only messages with ‘fripost.org’ (or a subdomain of such) as recipient domain. Other domains, even those using mx[12].fripost.org as MX, are not covered. A scalable solution for arbitrary domains would involve either DANE and TLSA records, or MTA-STS [RFC8461]. Regardless, there is some merit in hardcoding our internal policy (when the client and server are both under our control) in the configuration. It for instance enables us to harden TLS ciphers and protocols, and makes the verification logic independent of DNS.
* nginx: Update trusted certificate used for OCSP stapling.Guilhem Moulin2020-12-051
| | | | See https://bugs.debian.org/975862 .
* Firewall: Always include 172.16.0.0/12 to the bogon list.Guilhem Moulin2020-11-151
| | | | | Our IPsec subnet is in that subnet but the setup won't deal well with subnet overlap so it's best to explicitely not support NATed machines with an IP in 172.16.0.0/12.
* Firewall: Add counter to dropped ICMP packets.Guilhem Moulin2020-11-151
|
* rkhunter: workaround for mix usrmerge/non-usrmerge environments.Guilhem Moulin2020-11-151
| | | | See https://bugs.debian.org/932594#15 .
* Firewall: ICMPv6: accept link-local multicast receiver notification messages.Guilhem Moulin2020-11-151
|
* typofixGuilhem Moulin2020-11-151
| | | | Regression from ead9aaa3dd7ca48012b2b21cc930ee73c8eaa9d3.
* Change NTP client to systemd-timesyncd.Guilhem Moulin2020-11-155
| | | | | | | | | (Excluding our NTP master.) It's simpler, arguably more secure, and provides enough functionality when only simple client use-cases are desired. We allow outgoing connections to 123/udp also on NTP slaves so systemd-timesyncd can connect to the fallbacks NTP servers.
* Bacula: tweak fileset and retention policy.Guilhem Moulin2020-11-151
| | | | | | In particular, trigger weekly differential backups for mailboxes, and exclude Dovecot's transaction/index/etc log and cache files which are constantly updated but not useful assets to backup.
* logcheck-database update.Guilhem Moulin2020-11-154
|
* Firewall: allow ICMP type 11 (time time-exceeded).Guilhem Moulin2020-11-031
| | | | This is in particular needed for traceroutes and routing loop detection.
* Revert "Bacula Director: Properly quote shell command."Guilhem Moulin2020-11-031
| | | | This reverts commit 26bae877102752a41a903cab2ee0891f8f261d38.
* Bacula: refactor systemd service files.Guilhem Moulin2020-11-036
| | | | | | Use unit overrides on top of upstream's service files instead of overriding entire service files. In particular, upstream uses flag `-P` so we don't need to use RuntimeDirectory= anymore.
* Firewall: Move IPsec/ICMP/ICMPv6 rules to ingress chain.Guilhem Moulin2020-11-031
| | | | | | | | This is required to receive incoming traffic to our IPsec IP in 172.16.0.0/24, as well as linked-scoped ICMPv6 traffic from/to fe80::/10 (for neighbour discovery). Regression from a6b8c0b3a4758f8d84a7ad07bb9e068075d098d3.
* Firewall: Move martian and bogus TCP filters early in the packet flow.Guilhem Moulin2020-11-021
| | | | | This is more efficient: the earlier we filter the crap out the less resources they consume.
* kernel parameters: Disable SYN cookies and improve SYN backlog handling.Guilhem Moulin2020-11-021
| | | | See tcp(7) and https://levelup.gitconnected.com/linux-kernel-tuning-for-high-performance-networking-high-volume-incoming-connections-196e863d458a .
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 03:18:31 +0000