Initial commit

ansible/roles/common/files/jail.local

@@ -0,0 +1,2 @@
+[sshd]
+enabled = true

ansible/roles/common/handlers/main.yml

@@ -0,0 +1,30 @@
+---
+- name: Restart ssh
+  service: 
+    name=sshd
+    state=restarted
+
+- name: Restart zabbix-agent
+  service: 
+    name=zabbix-agent
+    state=restarted
+
+- name: Restart postfix
+  service: 
+    name=postfix
+    state=restarted
+
+- name: Restart fail2ban
+  service: 
+    name=fail2ban
+    state=restarted
+
+- name: reload firewalld
+  systemd: 
+    name=firewalld
+    state=reloaded
+
+- name: Restore selinux context
+  command: restorecon -irv /home/appuser/wo-bisch-web
+
+

ansible/roles/common/tasks/main.yml

@@ -0,0 +1,170 @@
+---
+- name: install basic packages
+  yum:
+    name: "{{ packages }}"
+  vars:
+    packages:
+    - langpacks-en 
+    - langpacks-de 
+    - glibc-all-langpacks
+    - podman
+    - sysstat
+    - mailx
+    - bind-utils
+    - epel-release
+    - setroubleshoot-server
+    - socat
+    - unzip
+    - wget
+
+- name: Enable SELinux
+  selinux:
+    policy: targeted
+    state: enforcing
+
+- name: disable kdump
+  systemd:
+    name: kdump
+    enabled: no
+
+- name: Add Group appuser
+  group:
+    name: appuser
+    gid: 1000
+    state: present
+
+- name: Add User appuser
+  user:
+    name: appuser
+    shell: /bin/bash
+    uid: 1000
+    group: appuser
+    
+- name: Change permission of /home/appuser
+  file:
+    path: /home/appuser
+    state: directory
+    owner: appuser
+    group: appuser
+    mode: '0755'
+
+- name: Create /home/appuser/wo-bisch-web
+  file:
+    path: /home/appuser/wo-bisch-web
+    state: directory
+    owner: appuser
+    group: appuser
+    mode: '0755'
+
+- name: Allow apache to read files in /home/appuser/wo-bisch-web
+  sefcontext:
+    target: '/home/appuser/wo-bisch-web(/.*)?'
+    setype: httpd_sys_content_t
+    state: present
+  notify:
+    - Restore selinux context
+
+- name: allow root SSH with key only
+  lineinfile: dest=/etc/ssh/sshd_config
+              regexp="^PermitRootLogin"
+              line="PermitRootLogin without-password"
+              state=present
+  notify: Restart ssh
+
+- name: create /etc/hosts from template
+  template:
+    src: hosts.j2
+    dest: /etc/hosts
+    owner: root
+    group: root
+    backup: yes
+    mode: '0644'
+
+- name: install zabbix agent
+  yum:
+    name: zabbix40-agent
+
+- name: enable zabbix agent
+  systemd:
+    name: zabbix-agent
+    enabled: yes
+
+- name: zabbix config
+  lineinfile: dest=/etc/zabbix/zabbix_agentd.conf
+              regexp="^Server="
+              line="Server={{ zabbix_server_ip }}"
+              state=present
+  notify: Restart zabbix-agent
+
+- name: install postfix
+  yum:
+    name: postfix
+
+- name: enable postfix
+  systemd:
+    name: postfix
+    enabled: yes
+
+- name: postfix config
+  lineinfile: dest=/etc/postfix/main.cf
+              regexp="^relayhost"
+              line="relayhost = [{{ mailserver }}]:25"
+              state=present
+  notify: Restart postfix
+
+- name: postfix config
+  lineinfile: dest=/etc/postfix/main.cf
+              regexp="^myhostname"
+              line="myhostname = {{ ansible_hostname }}.{{ my_domain }}"
+              state=present
+  notify: Restart postfix
+
+- name: create .forward file
+  copy:
+    dest: "/root/.forward"
+    content: "{{ mail_forward_address }}\n"
+
+- name: install fail2ban
+  yum:
+    name: fail2ban
+
+- name: enable fail2ban
+  systemd:
+    name: fail2ban
+    enabled: yes
+
+- name: copy fail2ban config
+  copy:
+    src: jail.local
+    dest: /etc/fail2ban/jail.local
+    mode: '0644'
+  notify: Restart fail2ban
+
+- name: setup firewalld rules - services
+  firewalld:
+    service: "{{ item }}"
+    permanent: yes
+    state: enabled
+  loop:
+    - ssh
+    - http
+    - https
+  notify: reload firewalld
+
+- name: setup firewalld rules - remove services
+  firewalld:
+    service: "{{ item }}"
+    permanent: yes
+    state: disabled
+  loop:
+    - cockpit
+  notify: reload firewalld
+
+- name: setup firewalld rules - ports
+  firewalld:
+    port: "{{ item }}"
+    permanent: yes
+    state: enabled
+  loop:
+    - 10050/tcp
+  notify: reload firewalld

ansible/roles/common/templates/hosts.j2

@@ -0,0 +1,16 @@
+# Your system has configured 'manage_etc_hosts' as True.
+# As a result, if you wish for changes to this file to persist
+# then you will need to either
+# a.) make changes to the master file in /etc/cloud/templates/hosts.redhat.tmpl
+# b.) change or remove the value of 'manage_etc_hosts' in
+#     /etc/cloud/cloud.cfg or cloud-config from user-data
+# 
+# The following lines are desirable for IPv4 capable hosts
+{{ ansible_default_ipv4.address }} {{ ansible_hostname }}.{{ my_domain }} {{ ansible_hostname }}
+127.0.0.1 localhost.localdomain localhost
+127.0.0.1 localhost4.localdomain4 localhost4
+
+# The following lines are desirable for IPv6 capable hosts
+{{ ansible_default_ipv6.address }} {{ ansible_hostname }}.{{ my_domain }} {{ ansible_hostname }}
+::1 localhost.localdomain localhost
+::1 localhost6.localdomain6 localhost6