initial commit via gitinitshit
This commit is contained in:
@@ -0,0 +1,218 @@
|
||||
---
|
||||
- name: 'Configure Remote Servers'
|
||||
hosts: remoteservers
|
||||
vars_files:
|
||||
- './variables.yml'
|
||||
tasks:
|
||||
# packages
|
||||
- name: 'Updating apt cache'
|
||||
apt:
|
||||
force_apt_get: True
|
||||
update_cache: True
|
||||
- name: 'Upgrading all apt packages'
|
||||
apt:
|
||||
force_apt_get: True
|
||||
upgrade: full
|
||||
become: yes
|
||||
- name: 'Selected packages to install:'
|
||||
debug:
|
||||
msg: "{{ item }}"
|
||||
loop: "{{ list_of_packages }}"
|
||||
- name: "Installing packages"
|
||||
apt:
|
||||
force_apt_get: True
|
||||
name: "{{ list_of_packages }}"
|
||||
state: present
|
||||
- name: 'Remove useless packages from the cache'
|
||||
apt:
|
||||
force_apt_get: True
|
||||
autoclean: yes
|
||||
- name: 'Run the equivalent of apt-get clean'
|
||||
apt:
|
||||
force_apt_get: True
|
||||
clean: yes
|
||||
# add and configure the user
|
||||
- name: "Add the user {{ new_username }}"
|
||||
user:
|
||||
name: "{{ new_username }}"
|
||||
shell: "{{ login_shell }}"
|
||||
# password: "{{ user_password }}"
|
||||
groups: 'sudo,www-data'
|
||||
append: yes
|
||||
- name: "Set authorized key for {{ new_username }}"
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ new_username }}"
|
||||
key: "{{ ssh_key_auth }}"
|
||||
state: present
|
||||
# zsh
|
||||
- name: 'Setting up zsh'
|
||||
blockinfile:
|
||||
path: "/home/{{ new_username }}/.zshrc"
|
||||
block: |
|
||||
# Set up the prompt
|
||||
autoload -Uz promptinit
|
||||
promptinit
|
||||
prompt adam1
|
||||
setopt histignorealldups sharehistory
|
||||
# Use emacs keybindings even if our EDITOR is set to vi
|
||||
bindkey -e
|
||||
# Keep 1000 lines of history within the shell and save it to ~/.zsh_history:
|
||||
HISTSIZE=1000
|
||||
SAVEHIST=1000
|
||||
HISTFILE=~/.zsh_history
|
||||
# Use modern completion system
|
||||
autoload -Uz compinit
|
||||
compinit
|
||||
zstyle ':completion:*' auto-description 'specify: %d'
|
||||
zstyle ':completion:*' completer _expand _complete _correct _approximate
|
||||
zstyle ':completion:*' format 'Completing %d'
|
||||
zstyle ':completion:*' group-name ''
|
||||
zstyle ':completion:*' menu select=2
|
||||
eval "$(dircolors -b)"
|
||||
zstyle ':completion:*:default' list-colors ${(s.:.)LS_COLORS}
|
||||
zstyle ':completion:*' list-colors ''
|
||||
zstyle ':completion:*' list-prompt %SAt %p: Hit TAB for more, or the character to insert%s
|
||||
zstyle ':completion:*' matcher-list '' 'm:{a-z}={A-Z}' 'm:{a-zA-Z}={A-Za-z}' 'r:|[._-]=* r:|=* l:|=*'
|
||||
zstyle ':completion:*' menu select=long
|
||||
zstyle ':completion:*' select-prompt %SScrolling active: current selection at %p%s
|
||||
zstyle ':completion:*' use-compctl false
|
||||
zstyle ':completion:*' verbose true
|
||||
zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#)*=0=01;31'
|
||||
zstyle ':completion:*:kill:*' command 'ps -u $USER -o pid,%cpu,tty,cputime,cmd'
|
||||
eval $(thefuck --alias fuck)
|
||||
PATH=~/.local/bin/:$PATH
|
||||
mode: '0744'
|
||||
owner: "{{ new_username }}"
|
||||
group: "{{ new_username }}"
|
||||
state: present
|
||||
create: True
|
||||
# ufw
|
||||
- name: 'UFW default allow everything outgoing'
|
||||
community.general.ufw:
|
||||
default: allow
|
||||
direction: 'outgoing'
|
||||
- name: 'UFW default deny everything incoming'
|
||||
community.general.ufw:
|
||||
default: deny # reject to throw error instead of drop quietly
|
||||
direction: 'incoming'
|
||||
- name: 'UFW enable logging'
|
||||
community.general.ufw:
|
||||
logging: 'on'
|
||||
- name: 'UFW selected rules:'
|
||||
debug:
|
||||
msg: "{{item.name}}/{{item.proto}}"
|
||||
loop: "{{ open_services }}"
|
||||
- name: 'UFW setting rules'
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "{{ item.name }}"
|
||||
proto: "{{ item.proto }}"
|
||||
loop: "{{ open_services }}"
|
||||
- name: 'UFW enable'
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
become: yes
|
||||
# unattended upgrades
|
||||
- name: 'Unattended upgrades initial dpkg reconfigure'
|
||||
command:
|
||||
cmd: 'dpkg-reconfigure -f noninteractive unattended-upgrades'
|
||||
become: yes
|
||||
- name: 'Unattended upgrades configure 20auto-upgrades'
|
||||
blockinfile:
|
||||
dest: '/etc/apt/apt.conf.d/20auto-upgrades'
|
||||
block: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
state: present
|
||||
insertafter: EOF
|
||||
become: yes
|
||||
- name: 'Unattended upgrades configure 50unattended-upgrades'
|
||||
blockinfile:
|
||||
dest: '/etc/apt/apt.conf.d/50unattended-upgrades'
|
||||
block: |
|
||||
Unattended-Upgrade::Automatic-Reboot "true";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "{{ reboot_time }}";
|
||||
create: True
|
||||
insertafter: EOF
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
become: yes
|
||||
- name: 'Unattended upgrades configure daily timer'
|
||||
lineinfile:
|
||||
path: '/lib/systemd/system/apt-daily-upgrade.timer'
|
||||
regexp: '^OnCalendar'
|
||||
line: "OnCalendar=*-*-* {{ install_time }}"
|
||||
state: present
|
||||
become: yes
|
||||
- name: 'Unattended upgrades configure reboot offset'
|
||||
lineinfile:
|
||||
path: '/lib/systemd/system/apt-daily-upgrade.timer'
|
||||
regexp: '^RandomizedDelaySec'
|
||||
line: "RandomizedDelaySec={{ reboot_offset }}"
|
||||
state: present
|
||||
become: yes
|
||||
- name: 'Unattended upgrades last dpkg reconfigure'
|
||||
command:
|
||||
cmd: 'dpkg-reconfigure -f noninteractive unattended-upgrades'
|
||||
become: yes
|
||||
# customscripts
|
||||
- name: 'Customscripts download'
|
||||
git:
|
||||
repo: "{{ custom_scripts_repo }}"
|
||||
dest: '/tmp/cscripts'
|
||||
- name: "Create directory {{ custom_scripts_dir }}"
|
||||
file:
|
||||
path: "{{ custom_scripts_dir }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
become: yes
|
||||
- name: 'Customscripts installing'
|
||||
command:
|
||||
cmd: "cp /tmp/cscripts/customscripts/{{ item }} {{ custom_scripts_dir }}"
|
||||
loop: "{{ custom_scripts }}"
|
||||
become: yes
|
||||
- name: 'Customscripts activating'
|
||||
command:
|
||||
cmd: "chmod 755 {{ custom_scripts_dir }}/{{ item }}"
|
||||
loop: "{{ custom_scripts }}"
|
||||
become: yes
|
||||
# crontabs
|
||||
- name: 'Crontab chkrootkit'
|
||||
cron:
|
||||
name: 'chkrootkit'
|
||||
minute: '0'
|
||||
hour: '8'
|
||||
user: 'root'
|
||||
job: 'chkrootkit -q'
|
||||
state: present
|
||||
become: yes
|
||||
- name: 'Crontab lynis'
|
||||
cron:
|
||||
name: 'lynis'
|
||||
minute: '0'
|
||||
hour: '11'
|
||||
user: 'root'
|
||||
job: 'lynis -q'
|
||||
state: present
|
||||
become: yes
|
||||
# enable services
|
||||
- name: 'enable/restart nginx'
|
||||
service:
|
||||
name: 'nginx'
|
||||
enabled: True
|
||||
state: 'restarted'
|
||||
become: yes
|
||||
- name: 'enable/restart ssh'
|
||||
service:
|
||||
name: 'ssh'
|
||||
enabled: True
|
||||
state: 'restarted'
|
||||
become: yes
|
||||
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
[remoteservers]
|
||||
someserver ansible_user=root ansible_host=1.1.1.1
|
||||
@@ -0,0 +1,10 @@
|
||||
cd ~ && mkdir ansible-playbook && cd ansible-playbook
|
||||
ansible-playbook ansible-playbook.yml -i inventory.ini
|
||||
ansible remoteservers -m ping
|
||||
|
||||
# errata
|
||||
ssh root@ip
|
||||
passwd princesspi
|
||||
sudo nano /etc/ssh/sshd_config
|
||||
sudo ufw allow 8888
|
||||
sudo bash /usr/share/customscripts/crowdsec.sh
|
||||
@@ -0,0 +1,230 @@
|
||||
- name: "Install python3"
|
||||
apt:
|
||||
name: python3
|
||||
state: present
|
||||
- name: "Install python3-pip"
|
||||
apt:
|
||||
name: python3-pip
|
||||
state: present
|
||||
- name: "Install python3-virtualenv"
|
||||
apt:
|
||||
name: python3-virtualenv
|
||||
state: present
|
||||
- name: "Install thefuck"
|
||||
apt:
|
||||
name: thefuck
|
||||
state: present
|
||||
- name: "Install python3-setuptools"
|
||||
apt:
|
||||
name: python3-setuptools
|
||||
state: present
|
||||
- name: "Install nginx"
|
||||
apt:
|
||||
name: nginx
|
||||
state: present
|
||||
- name: "Install wget"
|
||||
apt:
|
||||
name: wget
|
||||
state: present
|
||||
- name: "Install htop"
|
||||
apt:
|
||||
name: htop
|
||||
state: present
|
||||
- name: "Install btop"
|
||||
apt:
|
||||
name: btop
|
||||
state: present
|
||||
- name: "Install lynx"
|
||||
apt:
|
||||
name: lynx
|
||||
state: present
|
||||
- name: "Install neovim"
|
||||
apt:
|
||||
name: neovim
|
||||
state: present
|
||||
- name: "Install docker.io"
|
||||
apt:
|
||||
name: docker.io
|
||||
state: present
|
||||
- name: "Install docker-compose"
|
||||
apt:
|
||||
name: docker-compose
|
||||
state: present
|
||||
- name: "Install screen"
|
||||
apt:
|
||||
name: screen
|
||||
state: present
|
||||
- name: "Install byobu"
|
||||
apt:
|
||||
name: byobu
|
||||
state: present
|
||||
- name: "Install zsh"
|
||||
apt:
|
||||
name: zsh
|
||||
state: present
|
||||
- name: "Install nmap"
|
||||
apt:
|
||||
name: nmap
|
||||
state: present
|
||||
- name: "Install iptraf"
|
||||
apt:
|
||||
name: iptraf
|
||||
state: present
|
||||
- name: "Install iotop"
|
||||
apt:
|
||||
name: iotop
|
||||
state: present
|
||||
- name: "Install zip"
|
||||
apt:
|
||||
name: zip
|
||||
state: present
|
||||
- name: "Install unzip"
|
||||
apt:
|
||||
name: unzip
|
||||
state: present
|
||||
- name: "Install net-tools"
|
||||
apt:
|
||||
name: net-tools
|
||||
state: present
|
||||
- name: "Install git"
|
||||
apt:
|
||||
name: git
|
||||
state: present
|
||||
- name: "Install chkrootkit"
|
||||
apt:
|
||||
name: chkrootkit
|
||||
state: present
|
||||
- name: "Install fail2ban"
|
||||
apt:
|
||||
name: fail2ban
|
||||
state: present
|
||||
- name: "Install lynis"
|
||||
apt:
|
||||
name: lynis
|
||||
state: present
|
||||
|
||||
|
||||
# thefuck
|
||||
- name: "thefuck append to .zshrc"
|
||||
lineinfile:
|
||||
path: "/home/{{ username }}/.zshrc"
|
||||
line: 'eval $(thefuck --alias fuck)'
|
||||
insertafter: EOF
|
||||
mode: '0744'
|
||||
owner: "{{ username }}"
|
||||
group: "{{ username }}"
|
||||
state: present
|
||||
create: True
|
||||
|
||||
# PATH
|
||||
- name: ".zshrc PATH adding ~/.local/bin"
|
||||
lineinfile:
|
||||
path: "/home/{{ username }}/.zshrc"
|
||||
line: 'PATH=~/.local/bin/:$PATH'
|
||||
state: present
|
||||
insertafter: EOF
|
||||
mode: "0744"
|
||||
owner: "{{ username }}"
|
||||
group: "{{ username }}"
|
||||
create: True
|
||||
become: True
|
||||
become_method: su
|
||||
become_user: "{{ username }}"
|
||||
|
||||
|
||||
# ssh
|
||||
- name: "SSH allow {{ username }} only"
|
||||
lineinfile:
|
||||
path: '/etc/ssh/sshd_config'
|
||||
line: "AllowUsers {{ username }}"
|
||||
state: present
|
||||
insertafter: EOF
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
- name: 'SSH disable password auth'
|
||||
lineinfile:
|
||||
path: '/etc/ssh/sshd_config'
|
||||
regexp: '^PermitRootLogin'
|
||||
line: 'PermitRootLogin no'
|
||||
state: present
|
||||
insertafter: EOF
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
|
||||
- name: "UFW allow ssh"
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: ssh
|
||||
proto: tcp
|
||||
delete: true
|
||||
- name: "UFW allow http"
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: http
|
||||
proto: any
|
||||
delete: true
|
||||
- name: "UFW allow https"
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: https
|
||||
proto: any
|
||||
delete: true
|
||||
|
||||
|
||||
- name: 'Customscripts download'
|
||||
command:
|
||||
cmd: 'git clone https://gitlab.com/princesspi/general-scripts-and-system-ssssssetup.git /tmp/cscripts'
|
||||
become: yes
|
||||
|
||||
|
||||
|
||||
- name: "Create directory {{ custom_scripts_dir }}"
|
||||
file:
|
||||
path: "{{ custom_scripts_dir }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
become: yes
|
||||
- name: 'Customscripts copy add_user_ssh.sh'
|
||||
copy:
|
||||
remote_src: False
|
||||
src: '/tmp/cscripts/customscripts/add_user_ssh.sh'
|
||||
dest: "{{ custom_scripts_dir }}/add_user_ssh.sh"
|
||||
mode: '0744'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
become: yes
|
||||
- name: "Customscripts copy crowdsec.sh"
|
||||
copy:
|
||||
remote_src: False
|
||||
src: '/tmp/cscripts/customscripts/crowdsec.sh'
|
||||
dest: "{{ custom_scripts_dir }}/crowdsec.sh"
|
||||
mode: '0744'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
become: yes
|
||||
- name: "Customscripts copy fix_permissions.sh"
|
||||
copy:
|
||||
remote_src: False
|
||||
src: '/tmp/cscripts/customscripts/fix_permissions.sh'
|
||||
dest: "{{ custom_scripts_dir }}/fix_permissions.sh"
|
||||
mode: '0744'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
become: yes
|
||||
|
||||
# crowdsec
|
||||
- name: 'Crowdsec'
|
||||
command:
|
||||
cmd: "bash {{ custom_scripts_dir }}/crowdsec.sh"
|
||||
become: yes
|
||||
|
||||
- name: 'enable/restart crowdsec'
|
||||
service:
|
||||
name: 'crowdsec'
|
||||
enabled: True
|
||||
state: 'restarted'
|
||||
@@ -0,0 +1,48 @@
|
||||
new_username: 'princesspi'
|
||||
install_time: '02:00'
|
||||
reboot_time: '03:00'
|
||||
reboot_offset: '20m'
|
||||
login_shell: '/usr/bin/zsh' # which zsh
|
||||
custom_scripts_dir: '/usr/share/customscripts'
|
||||
custom_scripts_repo: 'https://gitlab.com/princesspi/general-scripts-and-system-ssssssetup.git'
|
||||
# password is precalculated hash
|
||||
# mkpasswd --method=sha-512
|
||||
# defaultpassword###
|
||||
# user_password: '$6$n3ybB6uVX.BwKiR4$vjENClERci2hmAkn9d9a8EUFAfnUlsH.R6/8EIXx1bu.k.bC7l/aE//s9ONw/PcbSQ2.hRdUgjxFrJ54/NhBm0'
|
||||
ssh_key_auth: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2D+9oYQlTnu1zeVi2gHfTKE7+DDWiu1EibXNwB9g72'
|
||||
list_of_packages:
|
||||
- 'unattended-upgrades'
|
||||
- 'python3'
|
||||
- 'python3-pip'
|
||||
- 'python3-virtualenv'
|
||||
- 'python3-setuptools'
|
||||
- 'thefuck'
|
||||
- 'nginx'
|
||||
- 'wget'
|
||||
- 'htop'
|
||||
- 'btop'
|
||||
- 'lynx'
|
||||
- 'neovim'
|
||||
- 'docker.io'
|
||||
- 'docker-compose'
|
||||
- 'screen'
|
||||
- 'byobu'
|
||||
- 'zsh'
|
||||
- 'nmap'
|
||||
- 'iptraf'
|
||||
- 'iotop'
|
||||
- 'zip'
|
||||
- 'unzip'
|
||||
- 'net-tools'
|
||||
- 'git'
|
||||
- 'chkrootkit'
|
||||
- 'fail2ban'
|
||||
- 'lynis'
|
||||
open_services:
|
||||
- { name: 'ssh', proto: 'tcp' }
|
||||
- { name: 'http', proto: 'tcp' }
|
||||
- { name: 'https', proto: 'tcp' }
|
||||
custom_scripts:
|
||||
- 'crowdsec.sh'
|
||||
- 'add_user_ssh.sh'
|
||||
- 'fix_permissions.sh'
|
||||
Reference in New Issue
Block a user