Initial commit

ansible/roles/common/files/jail.local

@@ -0,0 +1,2 @@
+[sshd]
+enabled = true

ansible/roles/common/handlers/main.yml

@@ -0,0 +1,15 @@
+---
+- name: Restart ssh
+  service: 
+    name=sshd
+    state=restarted
+
+- name: Restart fail2ban
+  service: 
+    name=fail2ban
+    state=restarted
+
+- name: reload firewalld
+  systemd:
+    name=firewalld
+    state=reloaded

ansible/roles/common/tasks/main.yml

@@ -0,0 +1,104 @@
+---
+- name: install basic packages
+  yum:
+    name: "{{ packages }}"
+  vars:
+    packages:
+    - langpacks-en 
+    - langpacks-de 
+    - glibc-all-langpacks
+    - sysstat
+    - mailx
+    - bind-utils
+    - epel-release
+    - setroubleshoot-server
+    - telnet
+    - git
+    - yum-utils
+
+- name: Enable SELinux
+  selinux:
+    policy: targeted
+    state: enforcing
+
+- name: disable kdump
+  systemd:
+    name: kdump
+    enabled: no
+
+- name: allow root SSH with key only
+  lineinfile: dest=/etc/ssh/sshd_config
+              regexp="^PermitRootLogin"
+              line="PermitRootLogin without-password"
+              state=present
+  notify: Restart ssh
+
+- name: create /etc/hosts from template
+  template:
+    src: hosts.j2
+    dest: /etc/hosts
+    owner: root
+    group: root
+    backup: yes
+    mode: '0644'
+
+- name: install fail2ban
+  yum:
+    name: fail2ban
+
+- name: enable fail2ban
+  systemd:
+    name: fail2ban
+    enabled: yes
+
+- name: copy fail2ban config
+  copy:
+    src: jail.local
+    dest: /etc/fail2ban/jail.local
+    mode: '0644'
+  notify: Restart fail2ban
+
+- name: setup firewalld rules - services
+  firewalld:
+    service: "{{ item }}"
+    permanent: yes
+    state: enabled
+    immediate: yes
+  loop:
+    - ssh
+    - http
+    - https
+    - smtp
+    - smtps
+    - imap
+    - imaps
+    - pop3
+    - pop3s
+    - managesieve
+  notify: reload firewalld
+
+- name: setup firewalld rules - remove services
+  firewalld:
+    service: "{{ item }}"
+    permanent: yes
+    state: disabled
+  loop:
+    - cockpit
+  notify: reload firewalld
+
+- name: setup firewalld rules - ports
+  firewalld:
+    port: "{{ item }}"
+    permanent: yes
+    state: enabled
+  loop:
+    - 10050/tcp
+  notify: reload firewalld
+
+- name: Create ~/.forward
+  copy:
+    content: 'joerg.lehmann@nbit.ch'
+    dest: "/root/.forward"
+    owner: root
+    group: root
+    mode: '0644'

ansible/roles/common/templates/hosts.j2

@@ -0,0 +1,16 @@
+# Your system has configured 'manage_etc_hosts' as True.
+# As a result, if you wish for changes to this file to persist
+# then you will need to either
+# a.) make changes to the master file in /etc/cloud/templates/hosts.redhat.tmpl
+# b.) change or remove the value of 'manage_etc_hosts' in
+#     /etc/cloud/cloud.cfg or cloud-config from user-data
+# 
+# The following lines are desirable for IPv4 capable hosts
+{{ ansible_default_ipv4.address }} {{ ansible_hostname }}.{{ my_domain }} {{ ansible_hostname }}
+127.0.0.1 localhost.localdomain localhost
+127.0.0.1 localhost4.localdomain4 localhost4
+
+# The following lines are desirable for IPv6 capable hosts
+{{ ansible_default_ipv6.address }} {{ ansible_hostname }}.{{ my_domain }} {{ ansible_hostname }}
+::1 localhost.localdomain localhost
+::1 localhost6.localdomain6 localhost6