„basics-container.yml“ hinzufügen
This commit is contained in:
parent
866e62600d
commit
7cf59050d6
219
basics-container.yml
Normal file
219
basics-container.yml
Normal file
@ -0,0 +1,219 @@
|
||||
---
|
||||
- name: Basic Debian Linux Setup for Containers
|
||||
hosts: all
|
||||
tasks:
|
||||
#- name: Print all available facts
|
||||
# ansible.builtin.debug:
|
||||
# var: ansible_facts
|
||||
|
||||
- name: Install Basic Packages
|
||||
apt:
|
||||
name:
|
||||
- bc
|
||||
- psutils
|
||||
- psmisc
|
||||
- procps
|
||||
- htop
|
||||
- iotop
|
||||
- sysstat
|
||||
- strace
|
||||
- net-tools
|
||||
- vim
|
||||
- git
|
||||
- man-db
|
||||
- netcat
|
||||
- debconf-utils
|
||||
- iputils-ping
|
||||
- lsof
|
||||
- inotify-tools
|
||||
- rsync
|
||||
- dos2unix
|
||||
- locales
|
||||
- iproute2
|
||||
- cryptsetup
|
||||
- curl
|
||||
- moreutils
|
||||
- ffmpeg
|
||||
- mediainfo
|
||||
- telnet
|
||||
- libstring-approx-perl
|
||||
- postfix
|
||||
- zip
|
||||
- nmap
|
||||
- whois
|
||||
- libfile-readbackwards-perl
|
||||
- libcrypt-cbc-perl
|
||||
- libcrypt-des-perl
|
||||
- pwgen
|
||||
- certbot
|
||||
- jq
|
||||
- cifs-utils
|
||||
- apt-transport-https
|
||||
- golang
|
||||
- make
|
||||
- sshfs
|
||||
- imagemagick
|
||||
- libimage-exiftool-perl
|
||||
- sqlite3
|
||||
- html-xml-utils
|
||||
- ldmtool
|
||||
- openssh-server
|
||||
update_cache: yes
|
||||
install_recommends: no
|
||||
|
||||
- name: Set a hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{inventory_hostname}}"
|
||||
|
||||
- name: Remove root-Password
|
||||
user:
|
||||
name: root
|
||||
password: '*'
|
||||
|
||||
- name: Prefer ipv4 over ipv6 to avoid problems and waiting times
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/gai.conf
|
||||
regexp: '^#precedence ::ffff:0:0/96 100'
|
||||
line: "precedence ::ffff:0:0/96 100 # CHANGED BY ANSIBLE"
|
||||
backup: yes
|
||||
|
||||
- name: Ensure en_US.UTF-8 locale exists
|
||||
community.general.locale_gen:
|
||||
name: en_US.UTF-8
|
||||
state: present
|
||||
- name: Ensure en_GB.UTF-8 locale exists
|
||||
community.general.locale_gen:
|
||||
name: en_GB.UTF-8
|
||||
state: present
|
||||
- name: Ensure de_DE.UTF-8 locale exists
|
||||
community.general.locale_gen:
|
||||
name: de_DE.UTF-8
|
||||
state: present
|
||||
notify: localectl
|
||||
|
||||
- name: SSHD hardening
|
||||
blockinfile:
|
||||
path: /etc/ssh/sshd_config.d/hardening.conf
|
||||
mode: "0444"
|
||||
owner: root
|
||||
group: root
|
||||
create: yes
|
||||
insertbefore: BOF # Beginning of the file
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||
block: |
|
||||
Port 22
|
||||
Port 33
|
||||
PermitRootLogin prohibit-password
|
||||
PermitUserRC no
|
||||
PermitUserEnvironment no
|
||||
PubkeyAuthentication yes
|
||||
X11Forwarding no
|
||||
AllowAgentForwarding no
|
||||
AllowTcpForwarding yes
|
||||
Subsystem sftp internal-sftp -f AUTH -l INFO -u 0007
|
||||
## Ciphers Check https://sshcheck.com/server/{{inventory_hostname}}/
|
||||
# nmap -p22 -n -sV --script ssh2-enum-algos localhost
|
||||
KexAlgorithms curve25519-sha256@libssh.org
|
||||
HostKeyAlgorithms ssh-ed25519
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
|
||||
IgnoreRhosts yes
|
||||
LogLevel VERBOSE
|
||||
AddressFamily any
|
||||
backup: yes
|
||||
validate: /usr/sbin/sshd -T -f %s
|
||||
|
||||
- name: Disable external sftp-Subsystem
|
||||
replace:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '(^Subsystem.*sftp.*)'
|
||||
replace: '#\1'
|
||||
validate: /usr/sbin/sshd -T -f %s
|
||||
backup: yes
|
||||
|
||||
- name: Create .ssh dir
|
||||
ansible.builtin.file:
|
||||
path: /root/.ssh
|
||||
owner: root
|
||||
group: root
|
||||
state: directory
|
||||
mode: '0550'
|
||||
|
||||
- name: Generate an OpenSSH keypair ed25519
|
||||
community.crypto.openssh_keypair:
|
||||
path: /root/.ssh/id_ed25519
|
||||
type: ed25519
|
||||
|
||||
- name: shell profile
|
||||
blockinfile:
|
||||
path: /etc/profile.d/settings-from-ansible.sh
|
||||
create: yes
|
||||
mode: "0444"
|
||||
owner: root
|
||||
group: root
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||
block: |
|
||||
if ${use_color} ; then
|
||||
if [[ ${EUID} == 0 ]] ; then
|
||||
PS1='\[\033[01;31m\]\h\[\033[01;34m\] \w \$\[\033[00m\] '
|
||||
else
|
||||
PS1='\[\033[01;32m\]\u@\h\[\033[01;34m\] \w \$\[\033[00m\] '
|
||||
fi
|
||||
export EDITOR="/usr/bin/vim"
|
||||
export HISTSIZE=
|
||||
export HISTFILESIZE=
|
||||
export HISTTIMEFORMAT="[%F %T] "
|
||||
if [ -f /etc/debian_version ]
|
||||
then
|
||||
export DEBIAN_FRONTEND='noninteractive'
|
||||
export LANG="en_US.UTF-8"
|
||||
alias ls='ls --color=auto'
|
||||
alias grep='grep --colour=auto'
|
||||
alias egrep='egrep --colour=auto'
|
||||
alias fgrep='fgrep --colour=auto'
|
||||
fi
|
||||
else
|
||||
# show root@ when we don't have colors
|
||||
PS1+='\u@\h \w \$'
|
||||
fi
|
||||
# execute for linuxmint
|
||||
if [ -d /etc/linuxmint ]
|
||||
then
|
||||
grep -q /etc/profile.d/settings-from-ansible.sh ~/.bashrc || echo '. /etc/profile.d/settings-from-ansible.sh' >> ~/.bashrc
|
||||
export LANG="de_DE.UTF-8"
|
||||
#for rc in ~/.bashrc /etc/skel/.bashrc
|
||||
#do
|
||||
# grep -q /etc/profile.d/settings-from-ansible.sh $rc || echo '. /etc/profile.d/settings-from-ansible.sh' >> $rc
|
||||
#done
|
||||
fi
|
||||
backup: yes
|
||||
validate: /bin/bash -n %s
|
||||
|
||||
- name: vim settings
|
||||
blockinfile:
|
||||
path: /etc/vim/vimrc.local
|
||||
mode: "0444"
|
||||
owner: root
|
||||
group: root
|
||||
create: yes
|
||||
marker: "\" {mark} ANSIBLE MANAGED BLOCK"
|
||||
block: |
|
||||
:syntax on
|
||||
let g:skip_defaults_vim = 1
|
||||
set encoding=utf-8
|
||||
set tabstop=2 softtabstop=0 expandtab shiftwidth=2 smarttab
|
||||
syntax match nonascii "[^[:alnum:][:punct:][:space:]]/"
|
||||
highlight nonascii guibg=Red ctermbg=2
|
||||
backup: yes
|
||||
|
||||
- name: gaboshlib from git
|
||||
ansible.builtin.git:
|
||||
repo: 'https://gitea.ds9.dedyn.io/olli/gaboshlib.git'
|
||||
dest: /etc/bash
|
||||
force: yes
|
||||
|
||||
handlers:
|
||||
|
||||
- name: localectl
|
||||
ansible.builtin.shell: localectl set-locale LANG=de_DE.UTF-8
|
||||
|
||||
Loading…
Reference in New Issue
Block a user