2015-05-26 19:53:55 +00:00
---
2015-06-07 21:47:49 +00:00
- name : protect sysctl.conf
2017-08-04 19:45:04 +00:00
file :
path : '/etc/sysctl.conf'
owner : 'root'
group : 'root'
mode : '0440'
2015-06-07 21:47:49 +00:00
2017-08-04 19:45:04 +00:00
- name : set Daemon umask, do config for rhel-family | NSA 2.2.4.1
template :
src : 'rhel_sysconfig_init.j2'
dest : '/etc/sysconfig/init'
owner : 'root'
group : 'root'
mode : '0544'
2015-06-07 21:47:49 +00:00
when : ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
2017-01-23 18:50:02 +00:00
- name : install initramfs-tools
2017-08-04 19:45:04 +00:00
apt :
name : 'initramfs-tools'
state : 'installed'
update_cache : true
2017-01-23 18:50:02 +00:00
when : ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
2015-06-07 21:47:49 +00:00
- name : rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
2017-08-04 19:45:04 +00:00
template :
src : 'modules.j2'
dest : '/etc/initramfs-tools/modules'
owner : 'root'
group : 'root'
mode : '0440'
2015-06-07 21:47:49 +00:00
when : ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
register : initramfs
- name : update-initramfs
command : 'update-initramfs -u'
when : initramfs.changed
2017-04-23 15:04:18 +00:00
- name : create a combined sysctl-dict if overwrites are defined
2017-08-04 19:45:04 +00:00
set_fact :
sysctl_config : '{{ sysctl_config | combine(sysctl_overwrite) }}'
2017-06-06 14:39:13 +00:00
when : sysctl_overwrite | default()
2017-04-23 15:04:18 +00:00
2015-06-06 18:29:37 +00:00
- name : Change various sysctl-settings, look at the sysctl-vars file for documentation
sysctl :
name : '{{ item.key }}'
value : '{{ item.value }}'
sysctl_set : yes
state : present
reload : yes
ignoreerrors : yes
2016-05-17 18:35:41 +00:00
with_dict : '{{ sysctl_config }}'
2015-06-06 18:29:37 +00:00
2017-08-07 19:27:20 +00:00
- name : Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
2015-06-06 18:29:37 +00:00
sysctl :
name : '{{ item.key }}'
value : '{{ item.value }}'
state : present
reload : yes
ignoreerrors : yes
2016-05-17 18:35:41 +00:00
with_dict : '{{ sysctl_rhel_config }}'
2017-08-07 19:27:20 +00:00
when : (ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS') and ansible_distribution_major_version < '7'
2016-05-19 20:35:12 +00:00
- name : Apply ufw defaults
2017-08-04 19:45:04 +00:00
template :
src : 'ufw.j2'
dest : '/etc/default/ufw'
2016-05-19 20:35:12 +00:00
when : ufw_manage_defaults and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
2016-05-21 05:17:06 +00:00
tags : ufw