From: Oleg Broytman Date: Sat, 31 Aug 2019 19:52:40 +0000 (+0300) Subject: Feat(RedHat): Add RedHat and redhatoids playbooks and roles X-Git-Url: https://git.phdru.name/?a=commitdiff_plain;h=76942f35b0b978244f917e28694b78f43e8f8860;p=ansible.git Feat(RedHat): Add RedHat and redhatoids playbooks and roles Tested with Fedora 30. --- diff --git a/playbooks/redhat/README.txt b/playbooks/redhat/README.txt new file mode 100644 index 0000000..6dc5901 --- /dev/null +++ b/playbooks/redhat/README.txt @@ -0,0 +1,3 @@ +RedHat and redhatoids playbooks. + +Tested with Fedora 30. diff --git a/playbooks/redhat/init-local-phd.yml b/playbooks/redhat/init-local-phd.yml new file mode 100644 index 0000000..0fb6baf --- /dev/null +++ b/playbooks/redhat/init-local-phd.yml @@ -0,0 +1,27 @@ +- name: Update local user phd + hosts: localhost + gather_facts: false + vars: + system_groups: root,wheel,adm,disk,cdrom,floppy,audio,video,users,mail,input + tasks: + - name: Create system groups + become: true + group: + name: "{{ item }}" + system: true + loop: "{{ system_groups.split(',') }}" + - name: Create group phd + become: true + group: + name: phd + - name: user phd + become: true + user: + name: phd + groups: "{{ system_groups }}" + - name: Install X11 + become: true + dnf: + name: ['fvwm', 'rxvt-unicode', 'xorg'] + state: latest + update_cache: yes diff --git a/playbooks/redhat/init-system.sh b/playbooks/redhat/init-system.sh new file mode 100755 index 0000000..085eb3a --- /dev/null +++ b/playbooks/redhat/init-system.sh @@ -0,0 +1,18 @@ +#! /bin/sh + +if [ -z "$1" ]; then + echo "Usage: $0 host [...params...]" >&2 + exit 1 +fi + +host="$1" +shift + +cd "`dirname \"$0\"`" && +ANSIBLE_ROLES_PATH=roles:../roles && +export ANSIBLE_ROLES_PATH && + +# Passwordless access isn't configured yet; use `ssh` connection sharing. +# `sudo` isn't configured yet too; ask for phd password. +ansible-playbook init-system.yml "$@" -e hosts="$host" -K && +exec ansible-playbook init-system2.yml "$@" -e hosts="$host" diff --git a/playbooks/redhat/init-system.yml b/playbooks/redhat/init-system.yml new file mode 100644 index 0000000..b1dbd68 --- /dev/null +++ b/playbooks/redhat/init-system.yml @@ -0,0 +1,6 @@ +- name: Setup Debain system + hosts: "{{ hosts | default('all') }}" + gather_facts: false + roles: + - sudo + - phd diff --git a/playbooks/redhat/init-system2.yml b/playbooks/redhat/init-system2.yml new file mode 100644 index 0000000..75dd28a --- /dev/null +++ b/playbooks/redhat/init-system2.yml @@ -0,0 +1,9 @@ +- name: Setup Debain system - part 2 + hosts: "{{ hosts | default('all') }}" + gather_facts: true + roles: + - init-system2 + - root + - firewall + - logcheck + - sshd diff --git a/playbooks/redhat/roles/dev-packages/README.txt b/playbooks/redhat/roles/dev-packages/README.txt new file mode 100644 index 0000000..13d6c5f --- /dev/null +++ b/playbooks/redhat/roles/dev-packages/README.txt @@ -0,0 +1 @@ +Install development packages. diff --git a/playbooks/redhat/roles/dev-packages/tasks/main.yml b/playbooks/redhat/roles/dev-packages/tasks/main.yml new file mode 100644 index 0000000..ed57bf4 --- /dev/null +++ b/playbooks/redhat/roles/dev-packages/tasks/main.yml @@ -0,0 +1,7 @@ +- name: Install development packages + become: true + dnf: + name: ['gcc', 'gcc-c++', 'git', 'make', + ] + state: latest + update_cache: yes diff --git a/playbooks/redhat/roles/firewall/README.txt b/playbooks/redhat/roles/firewall/README.txt new file mode 100644 index 0000000..c90cb67 --- /dev/null +++ b/playbooks/redhat/roles/firewall/README.txt @@ -0,0 +1,3 @@ +Configure iptables firewall. + +Allow everything out, limit in, disable forward. diff --git a/playbooks/redhat/roles/firewall/files/etc/network/functions.phd b/playbooks/redhat/roles/firewall/files/etc/network/functions.phd new file mode 100644 index 0000000..08f3718 --- /dev/null +++ b/playbooks/redhat/roles/firewall/files/etc/network/functions.phd @@ -0,0 +1,61 @@ +IPTABLES=/sbin/iptables +PATH=/sbin:/bin:/usr/sbin:/usr/bin + +my_ip() { + MYIP=$1 + + # Allow everything from this host + $IPTABLES -A INPUT -s $MYIP -j ACCEPT + + # Allow ICMP + $IPTABLES -A INPUT -d $MYIP -p icmp -j ACCEPT + + # Allow ports >1024 + $IPTABLES -A INPUT -d $MYIP -p tcp --dport 1024: ! --syn -j ACCEPT + $IPTABLES -A INPUT -d $MYIP -p udp --dport 1024: -j ACCEPT +} + +start_firewall() { + # Allow everything from localhost + $IPTABLES -A INPUT -s 127.0.0.1 -j ACCEPT + + # Specifically block access to NFS and XWindows. Neccessary because these are ports >1024 + $IPTABLES -A INPUT -p tcp --dport 2049 -j DROP + $IPTABLES -A INPUT -p udp --dport 2049 -j DROP + $IPTABLES -A INPUT -p tcp --dport 6000:6063 -j DROP + $IPTABLES -A INPUT -p udp --dport 6000:6063 -j DROP + + # Allow incoming ssh, smtp, dns, dhcp, www, ident, ntp, smb, OpenVPN, git-daemon + $IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 53 -j ACCEPT + $IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT + $IPTABLES -A INPUT -p udp --sport 53 --dport 1024: -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 113 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 123 -j ACCEPT + $IPTABLES -A INPUT -p udp --dport 123 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 137:139 -j ACCEPT + $IPTABLES -A INPUT -p udp --dport 137:139 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 445 -j ACCEPT + $IPTABLES -A INPUT -p udp --dport 1194 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 9418 -j ACCEPT + + # FTP + $IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT + # Allow ftp-data for active connections + #$IPTABLES -A INPUT -p tcp --sport 20 --dport 1024: -j ACCEPT + + # Track FTP connections to allow active and passive mode FTP + $IPTABLES -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT + $IPTABLES -A INPUT -p tcp --sport 21 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT + $IPTABLES -A INPUT -p tcp --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT + $IPTABLES -A INPUT -p tcp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT + + MY_IP=$(ip -o -4 addr show up | awk '{split($4,a,/\//); if (a[1] != "127.0.0.1") print a[1]}') + for ip in $MY_IP; do my_ip "$ip"; done +} diff --git a/playbooks/redhat/roles/firewall/files/etc/network/if-down.d/eth b/playbooks/redhat/roles/firewall/files/etc/network/if-down.d/eth new file mode 100755 index 0000000..b75a12b --- /dev/null +++ b/playbooks/redhat/roles/firewall/files/etc/network/if-down.d/eth @@ -0,0 +1,2 @@ +#!/bin/sh +exec /etc/rc.d/init.d/iptables.sh start diff --git a/playbooks/redhat/roles/firewall/files/etc/network/if-up.d/eth b/playbooks/redhat/roles/firewall/files/etc/network/if-up.d/eth new file mode 100755 index 0000000..b75a12b --- /dev/null +++ b/playbooks/redhat/roles/firewall/files/etc/network/if-up.d/eth @@ -0,0 +1,2 @@ +#!/bin/sh +exec /etc/rc.d/init.d/iptables.sh start diff --git a/playbooks/redhat/roles/firewall/files/etc/rc.d/init.d/iptables.sh b/playbooks/redhat/roles/firewall/files/etc/rc.d/init.d/iptables.sh new file mode 100755 index 0000000..72e43e6 --- /dev/null +++ b/playbooks/redhat/roles/firewall/files/etc/rc.d/init.d/iptables.sh @@ -0,0 +1,62 @@ +#!/bin/sh +### BEGIN INIT INFO +# Provides: iptables.sh +# Required-Start: $remote_fs $network +# Required-Stop: $remote_fs +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: iptables firewall +### END INIT INFO + +# Setup ip firewall + +. /etc/network/functions.phd + +case "$1" in + start) + systemctl stop fail2ban.service + + # Start afresh + $IPTABLES -F + $IPTABLES -F -t nat + $IPTABLES -F -t mangle + + # Default policies + $IPTABLES -P INPUT DROP + $IPTABLES -P OUTPUT ACCEPT + $IPTABLES -P FORWARD DROP + + start_firewall + /etc/rc.d/init.d/rc.masq + systemctl start fail2ban.service + ;; + + stop) + systemctl stop fail2ban.service + + $IPTABLES -F + $IPTABLES -F -t nat + $IPTABLES -F -t mangle + $IPTABLES -P INPUT DROP + $IPTABLES -P OUTPUT DROP + $IPTABLES -P FORWARD DROP + ;; + + clear) + systemctl stop fail2ban.service + + # Flush (delete) all rules + $IPTABLES -F + $IPTABLES -F -t nat + $IPTABLES -F -t mangle + $IPTABLES -P INPUT ACCEPT + $IPTABLES -P OUTPUT ACCEPT + $IPTABLES -P FORWARD ACCEPT + ;; + + *) + echo "Usage: firewall {start|stop|clear}" + exit 1 +esac + +exit 0 diff --git a/playbooks/redhat/roles/firewall/files/etc/rc.d/init.d/rc.masq b/playbooks/redhat/roles/firewall/files/etc/rc.d/init.d/rc.masq new file mode 100755 index 0000000..69be427 --- /dev/null +++ b/playbooks/redhat/roles/firewall/files/etc/rc.d/init.d/rc.masq @@ -0,0 +1,92 @@ +#!/bin/sh +# +# rc.masq - IP Masquerade +# +# Load all required IP MASQ modules +# +# NOTE: Only load the IP MASQ modules you need. All current IP MASQ modules +# are shown below but are commented out from loading. + +# Needed to initially load modules +# +#/sbin/depmod -a + +# Supports the proper masquerading of FTP file transfers using the PORT method +# +#/sbin/modprobe ip_masq_ftp + +# Supports the masquerading of RealAudio over UDP. Without this module, +# RealAudio WILL function but in TCP mode. This can cause a reduction +# in sound quality +# +#/sbin/modprobe ip_masq_raudio + +# Supports the masquerading of IRC DCC file transfers +# +#/sbin/modprobe ip_masq_irc + + +# Supports the masquerading of Quake and QuakeWorld by default. This modules is +# for for multiple users behind the Linux MASQ server. If you are going to play +# Quake I, II, and III, use the second example. +# +# NOTE: If you get ERRORs loading the QUAKE module, you are running an old +# ----- kernel that has bugs in it. Please upgrade to the newest kernel. +# +#Quake I / QuakeWorld (ports 26000 and 27000) +#/sbin/modprobe ip_masq_quake +# +#Quake I/II/III / QuakeWorld (ports 26000, 27000, 27910, 27960) +#/sbin/modprobe ip_masq_quake 26000,27000,27910,27960 + + +# Supports the masquerading of the CuSeeme video conferencing software +# +#/sbin/modprobe ip_masq_cuseeme + +#Supports the masquerading of the VDO-live video conferencing software +# +#/sbin/modprobe ip_masq_vdolive + + +#CRITICAL: Enable IP forwarding since it is disabled by default since +# +# Redhat Users: you may try changing the options in /etc/sysconfig/network from: +# +# FORWARD_IPV4=false +# to +# FORWARD_IPV4=true +# +echo 1 > /proc/sys/net/ipv4/ip_forward + + +# Dynamic IP users: +# +# If you get your IP address dynamically from SLIP, PPP, or DHCP, enable this following +# option. This enables dynamic-ip address hacking in IP MASQ, making the life +# with Diald and similar programs much easier. +# +#echo "1" > /proc/sys/net/ipv4/ip_dynaddr + + +IPTABLES=/sbin/iptables + + +# DHCP: For people who receive their external IP address from either DHCP or BOOTP +# such as ADSL or Cablemodem users, it is necessary to use the following +# before the deny command. The "bootp_client_net_if_name" should be replaced +# the name of the link that the DHCP/BOOTP server will put an address on to? +# This will be something like "eth0", "eth1", etc. +# +# This example is currently commented out. +# +# +#$IPCHAINS -A input -j ACCEPT -i bootp_clients_net_if_name -s 0/0 67 -d 0/0 68 -p udp + +# Enable simple IP forwarding and Masquerading +# +# NOTE: The following is an example for an internal LAN address in the 192.168.0.x +# network with a 255.255.255.0 or a "24" bit subnet mask. +# +# Please change this network number and subnet mask to match your internal LAN setup +# diff --git a/playbooks/redhat/roles/firewall/tasks/main.yml b/playbooks/redhat/roles/firewall/tasks/main.yml new file mode 100644 index 0000000..c1624fd --- /dev/null +++ b/playbooks/redhat/roles/firewall/tasks/main.yml @@ -0,0 +1,52 @@ +- name: Install fail2ban and iptables-services + become: true + dnf: + name: ['fail2ban', 'iptables-services'] + state: latest + update_cache: yes + register: services + +- name: Disable firewalld + become: true + service: + name: firewalld.service + state: stopped + enabled: no + +- name: Enable fail2ban + become: true + service: + name: fail2ban + state: started + enabled: yes + +- name: Enable iptables-service + become: true + service: + name: iptables + state: started + enabled: yes + +- name: Configure firewall + become: true + copy: + src: etc + dest: / + owner: root + group: root + directory_mode: '0750' + mode: '0750' + force: no + register: etc + +- name: Fix permissions for /etc/network/functions + become: true + file: + path: /etc/network/functions.phd + mode: '0640' + register: functions + +- name: Start iptables + become: true + command: /etc/rc.d/init.d/iptables.sh start + when: services.changed or etc.changed or functions.changed diff --git a/playbooks/redhat/roles/init-system/README.txt b/playbooks/redhat/roles/init-system/README.txt new file mode 100644 index 0000000..60e0fd1 --- /dev/null +++ b/playbooks/redhat/roles/init-system/README.txt @@ -0,0 +1 @@ +Init new RPM system: configure yum/dnf, install minimal list of packages. diff --git a/playbooks/redhat/roles/init-system/tasks/dnf.yml b/playbooks/redhat/roles/init-system/tasks/dnf.yml new file mode 100644 index 0000000..df265fc --- /dev/null +++ b/playbooks/redhat/roles/init-system/tasks/dnf.yml @@ -0,0 +1,10 @@ +- name: Install minimal software packages + become: true + dnf: + name: ['bash', 'bash-completion', 'bzip2', + 'curl', 'dnsutils', 'dselect', + 'gnupg', 'gnupg2', 'logcheck', 'mc', 'mutt', + 'procmail', 'rsync', 'unzip', 'vim', 'wget', 'zip', + ] + state: latest + update_cache: yes diff --git a/playbooks/redhat/roles/init-system/tasks/main.yml b/playbooks/redhat/roles/init-system/tasks/main.yml new file mode 100644 index 0000000..fbef08b --- /dev/null +++ b/playbooks/redhat/roles/init-system/tasks/main.yml @@ -0,0 +1,5 @@ +- name: packages + import_tasks: dnf.yml + +- name: Python + import_tasks: python.yml diff --git a/playbooks/redhat/roles/init-system/tasks/python.yml b/playbooks/redhat/roles/init-system/tasks/python.yml new file mode 100644 index 0000000..15dc994 --- /dev/null +++ b/playbooks/redhat/roles/init-system/tasks/python.yml @@ -0,0 +1,17 @@ +- name: Install Python and packages + become: true + dnf: + name: ['python2', 'python3', 'python2-pip', 'python3-pip', + 'python2-setuptools', 'python3-setuptools', + ] + state: latest + update_cache: yes + register: python + +- name: Upgrade Python packages + become: true + shell: 'umask 022; {{ item }} -m pip install --upgrade + "pip < 19.1" setuptools tox virtualenv virtualenvwrapper "wheel < 0.31.1" + flake8 sphinx twine' + when: python.changed + loop: ['python3', 'python2'] diff --git a/playbooks/redhat/roles/init-system2/README.txt b/playbooks/redhat/roles/init-system2/README.txt new file mode 100644 index 0000000..2b60b3c --- /dev/null +++ b/playbooks/redhat/roles/init-system2/README.txt @@ -0,0 +1 @@ +Init RPM system: phase2 - setup /usr/local. diff --git a/playbooks/redhat/roles/init-system2/tasks/main.yml b/playbooks/redhat/roles/init-system2/tasks/main.yml new file mode 100644 index 0000000..991cf55 --- /dev/null +++ b/playbooks/redhat/roles/init-system2/tasks/main.yml @@ -0,0 +1,25 @@ +- name: Setup /usr/local + become: true + file: + path: /usr/local + state: directory + owner: root + group: wheel + recurse: yes + +- name: Setup directories under /usr/local + become: true + command: find /usr/local -type d -exec chown root.wheel {} + -exec chmod ug+rwx,o+rx,g+s {} + + +- name: Setup files under /usr/local + become: true + command: find /usr/local -type f -exec chmod ug+rwX,o+rX {} + + +- name: Setup /usr/local/src + become: true + file: + path: /usr/local/src + state: directory + owner: phd + group: wheel + recurse: yes diff --git a/playbooks/redhat/roles/logcheck/README.txt b/playbooks/redhat/roles/logcheck/README.txt new file mode 100644 index 0000000..670499d --- /dev/null +++ b/playbooks/redhat/roles/logcheck/README.txt @@ -0,0 +1 @@ +Update logcheck ignore patterns. diff --git a/playbooks/redhat/roles/logcheck/files/.gitignore b/playbooks/redhat/roles/logcheck/files/.gitignore new file mode 100644 index 0000000..f8a9fd0 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/.gitignore @@ -0,0 +1 @@ +ignore.d/local-dhcpd diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-bluetooth b/playbooks/redhat/roles/logcheck/files/ignore.d/local-bluetooth new file mode 100644 index 0000000..119a65e --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-bluetooth @@ -0,0 +1 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint (un)?registered: sender=:[0-9.]+ path=/MediaEndpoint/ diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-console-kit-daemon b/playbooks/redhat/roles/logcheck/files/ignore.d/local-console-kit-daemon new file mode 100644 index 0000000..1169ef9 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-console-kit-daemon @@ -0,0 +1,2 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ console-kit-daemon\[[0-9]+\]: GLib-CRITICAL: Source ID [0-9]+ was not found when attempting to remove it$ + diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-dbus b/playbooks/redhat/roles/logcheck/files/ignore.d/local-dbus new file mode 100644 index 0000000..7661db8 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-dbus @@ -0,0 +1,3 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dbus\[[0-9]+\]: \[system\] Activating service name='org\.freedesktop\.UDisks' \(using servicehelper\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dbus\[[0-9]+\]: \[system\] Successfully activated service 'org\.freedesktop\.UDisks'$ + diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-firefox b/playbooks/redhat/roles/logcheck/files/ignore.d/local-firefox new file mode 100644 index 0000000..620f89a --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-firefox @@ -0,0 +1 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ firefox: getaddrinfo\*\.gaih_getanswer: got type "DNAME"$ diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-kernel b/playbooks/redhat/roles/logcheck/files/ignore.d/local-kernel new file mode 100644 index 0000000..d200924 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-kernel @@ -0,0 +1,6 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: \[[ 0-9.]+\] CIFS VFS: Server [0-9.]+ has not responded in 120 seconds\. Reconnecting\.\.\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: \[[ 0-9.]+\] Peer [0-9.:/]+ unexpectedly shrunk window [0-9]+:[0-9]+ \(repaired\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: \[[ 0-9.]+\] TCP: request_sock_TCP: Possible SYN flooding on port [0-9]+\. Sending cookies\. Check SNMP counters\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: \[[ 0-9.]+\] ncpfs: ncp_evict_inode: could not close +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: \[[ 0-9.]+\] net_ratelimit: [0-9]+ callbacks suppressed$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: \[[ 0-9.]+\] perf: interrupt took too long diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-minidsspd b/playbooks/redhat/roles/logcheck/files/ignore.d/local-minidsspd new file mode 100644 index 0000000..7d22d5d --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-minidsspd @@ -0,0 +1 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ minissdpd\[[0-9]+\]: method , don't know what to do diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-named b/playbooks/redhat/roles/logcheck/files/ignore.d/local-named new file mode 100644 index 0000000..634a8cb --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-named @@ -0,0 +1,6 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: DNS format error from ([0-9]{1,3}\.){3}[0-9]{1,3}#[0-9]{1,5} resolving +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client ([0-9]{1,3}\.){3}[0-9]{1,3}#[0-9]{1,5}: message parsing failed +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client ([0-9]{1,3}\.){3}[0-9]{1,3}#[0-9]{1,5} \([._[:alnum:]-]+\): query (\(cache\) )?'.+' denied +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: client 192\.168\.3\.20#[0-9]+ \([._[:alnum:]-]+\): error sending response: host unreachable$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: clients-per-query (de|in)creased to +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ named\[[0-9]+\]: skipping nameserver '[A-Za-z0-9._-]+' because it is a CNAME, while resolving diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-pa b/playbooks/redhat/roles/logcheck/files/ignore.d/local-pa new file mode 100644 index 0000000..679db46 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-pa @@ -0,0 +1,3 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pulseaudio\[[[:digit:]]+\]: \[alsa-(sink|source)-ALC269VC Analog\] alsa-(sink|source)\.c: ALSA woke us up to (read|write) new data (from|to) the device, but there was actually nothing to (read|write)!$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pulseaudio\[[[:digit:]]+\]: \[alsa-(sink|source)-ALC269VC Analog\] alsa-(sink|source)\.c: Most likely this is a bug in the ALSA driver 'snd_hda_intel'\. Please report this issue to the ALSA developers\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pulseaudio\[[[:digit:]]+\]: \[alsa-(sink|source)-ALC269VC Analog\] alsa-(sink|source)\.c: We were woken up with POLL(IN|OUT) set -- however a subsequent snd_pcm_avail\(\) returned 0 or another value < min_avail.$ diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-postgres b/playbooks/redhat/roles/logcheck/files/ignore.d/local-postgres new file mode 100644 index 0000000..2fbc57d --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-postgres @@ -0,0 +1 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: \[[ .0-9]{11,13}\] postgres \([0-9]+\): /proc/[0-9]+/oom_adj is deprecated, please use /proc/[0-9]+/oom_score_adj instead\. diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-rsyslog b/playbooks/redhat/roles/logcheck/files/ignore.d/local-rsyslog new file mode 100644 index 0000000..f7be8aa --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-rsyslog @@ -0,0 +1,2 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (liblogging-stdlog|rsyslogd): {1,2}\[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd[0-9-]+: action 'action 17' (suspended|resumed) diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-runuser b/playbooks/redhat/roles/logcheck/files/ignore.d/local-runuser new file mode 100644 index 0000000..b0bb7ad --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-runuser @@ -0,0 +1 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ runuser: pam_unix\(runuser:session\): session (opened|closed) for user nobody diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-samba b/playbooks/redhat/roles/logcheck/files/ignore.d/local-samba new file mode 100644 index 0000000..8c6c053 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-samba @@ -0,0 +1,2 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd: pam_unix\(samba:session\): session opened for user +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd: pam_unix\(samba:session\): session closed for user diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-spamassassin b/playbooks/redhat/roles/logcheck/files/ignore.d/local-spamassassin new file mode 100644 index 0000000..7101aa0 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-spamassassin @@ -0,0 +1,4 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: dns: new_dns_packet: domain is utf8 flagged: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: prefork: adjust: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: spamd: handled cleanup of child +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ spamd\[[0-9]+\]: spamd: result: diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-ssh b/playbooks/redhat/roles/logcheck/files/ignore.d/local-ssh new file mode 100644 index 0000000..ae96ad6 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-ssh @@ -0,0 +1,18 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: (error: )?Received disconnect from +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: (packet_write_wait|ssh_dispatch_run_fatal): Connection from ([0-9]{1,3}\.){3}[0-9]{1,3} port [0-9]+: Broken pipe \[preauth\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Bad protocol version identification +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Connection (closed|reset) by ([0-9]{1,3}\.){3}[0-9]{1,3} port [0-9]+ \[preauth\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Did not receive identification string from ([0-9]{1,3}\.){3}[0-9]{1,3} port [0-9]+ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Disconnected from ([0-9]{1,3}\.){3}[0-9]{1,3} port [0-9]+ \[preauth\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Disconnecting: Change of username or service not allowed: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Disconnecting: Too many authentication failures +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Failed password for invalid user.+from ([0-9]{1,3}\.){3}[0-9]{1,3} port [0-9]+ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Invalid user.+from ([0-9]{1,3}\.){3}[0-9]{1,3} +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: PAM service\(sshd\) ignoring max retries +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Unable to negotiate with ([0-9]{1,3}\.){3}[0-9]{1,3} port [0-9]+: no matching (host key type|key exchange method) found\. +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: fatal: (Read from socket|Write) failed: Connection reset by peer +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: fatal: Unable to negotiate a key exchange method \[preauth\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: fatal: no hostkey alg \[preauth\] +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: input_userauth_request: invalid user.+\[preauth\]$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: pam_unix(sshd:auth): bad username + diff --git a/playbooks/redhat/roles/logcheck/files/ignore.d/local-transmission b/playbooks/redhat/roles/logcheck/files/ignore.d/local-transmission new file mode 100644 index 0000000..c75af02 --- /dev/null +++ b/playbooks/redhat/roles/logcheck/files/ignore.d/local-transmission @@ -0,0 +1 @@ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ transmission-daemon\[[0-9]+\]: UDP Failed to set (send|receive) buffer: diff --git a/playbooks/redhat/roles/logcheck/tasks/main.yml b/playbooks/redhat/roles/logcheck/tasks/main.yml new file mode 100644 index 0000000..727d4ff --- /dev/null +++ b/playbooks/redhat/roles/logcheck/tasks/main.yml @@ -0,0 +1,25 @@ +- name: Install logcheck + become: true + dnf: + name: logcheck + state: latest + update_cache: yes + +- name: Configure logcheck + become: true + lineinfile: + path: /etc/logcheck/logcheck.conf + regexp: "^INTRO=0$" + line: "INTRO=0" + insertafter: "^#INTRO=1$" + +- name: Update logcheck ignore patterns + become: true + copy: + src: ignore.d/ + dest: "/etc/logcheck/ignore.d.{{ item }}" + owner: root + group: logcheck + directory_mode: '0750' + mode: 0640 + loop: ['server', 'workstation'] diff --git a/playbooks/redhat/roles/packages/README.txt b/playbooks/redhat/roles/packages/README.txt new file mode 100644 index 0000000..f68b96d --- /dev/null +++ b/playbooks/redhat/roles/packages/README.txt @@ -0,0 +1 @@ +Install RPM packages. diff --git a/playbooks/redhat/roles/packages/tasks/main.yml b/playbooks/redhat/roles/packages/tasks/main.yml new file mode 100644 index 0000000..af8cc80 --- /dev/null +++ b/playbooks/redhat/roles/packages/tasks/main.yml @@ -0,0 +1,8 @@ +- name: Install software packages + become: true + dnf: + name: ['adjtimex', 'arj', 'mailx', 'elinks', 'fetchmail', 'links', + 'lzip', 'lzma', 'lzop', 'p7zip', 'xz', + ] + state: latest + update_cache: yes diff --git a/playbooks/redhat/roles/phd/README.txt b/playbooks/redhat/roles/phd/README.txt new file mode 100644 index 0000000..84c7fa3 --- /dev/null +++ b/playbooks/redhat/roles/phd/README.txt @@ -0,0 +1,2 @@ +Init remote user phd: create system and user groups, create the user, +upload SSH public key. diff --git a/playbooks/redhat/roles/phd/defaults/main.yml b/playbooks/redhat/roles/phd/defaults/main.yml new file mode 100644 index 0000000..1e4d321 --- /dev/null +++ b/playbooks/redhat/roles/phd/defaults/main.yml @@ -0,0 +1 @@ +system_groups: root,wheel,adm,disk,cdrom,floppy,audio,video,users,mail,input diff --git a/playbooks/redhat/roles/phd/meta/main.yml b/playbooks/redhat/roles/phd/meta/main.yml new file mode 100644 index 0000000..8f82bb2 --- /dev/null +++ b/playbooks/redhat/roles/phd/meta/main.yml @@ -0,0 +1 @@ +dependencies: ['init-system'] diff --git a/playbooks/redhat/roles/phd/tasks/main.yml b/playbooks/redhat/roles/phd/tasks/main.yml new file mode 100644 index 0000000..8ed988b --- /dev/null +++ b/playbooks/redhat/roles/phd/tasks/main.yml @@ -0,0 +1,50 @@ +- name: Test if user phd already exists + stat: + path: "{{ item }}" + register: phd_exists + changed_when: not phd_exists.stat.exists + loop: ['~/.profile', '~/.shellrc'] + +- debug: + msg: "User phd has already been created" + when: phd_exists.results|selectattr('stat.exists')|list|length == 2 + +- name: Create and setup user phd + block: + - name: Create system groups + become: true + group: + name: "{{ item }}" + system: true + loop: "{{ system_groups.split(',') }}" + + - name: Create group phd + become: true + group: + name: phd + + - name: Add user phd + become: true + user: + name: phd + group: phd + groups: "{{ system_groups }}" + + - name: Remove mc directories + file: + path: "{{ item }}" + state: absent + loop: ['~/.cache/mc', '~/.config/mc', '~/.local/share/mc'] + + - name: Upload and extract home archive + unarchive: + src: ~/archive/STORE/phd/Home/phd.tar.bz2 + dest: /home + when: phd_exists.results|selectattr('stat.exists')|list|length != 2 + +- name: Add alias + become: true + lineinfile: + path: /etc/aliases + regexp: "^root: phd$" + line: "root: phd" diff --git a/playbooks/redhat/roles/sudo/README.txt b/playbooks/redhat/roles/sudo/README.txt new file mode 100644 index 0000000..9d2929b --- /dev/null +++ b/playbooks/redhat/roles/sudo/README.txt @@ -0,0 +1 @@ +Init sudo: install sudo, add user phd, allow passwordless operations. diff --git a/playbooks/redhat/roles/sudo/meta/main.yml b/playbooks/redhat/roles/sudo/meta/main.yml new file mode 100644 index 0000000..8f82bb2 --- /dev/null +++ b/playbooks/redhat/roles/sudo/meta/main.yml @@ -0,0 +1 @@ +dependencies: ['init-system'] diff --git a/playbooks/redhat/roles/sudo/tasks/main.yml b/playbooks/redhat/roles/sudo/tasks/main.yml new file mode 100644 index 0000000..469b9ae --- /dev/null +++ b/playbooks/redhat/roles/sudo/tasks/main.yml @@ -0,0 +1,8 @@ +- name: Allow passwordless operations for phd + become: true + copy: + content: 'phd ALL=(ALL:ALL) NOPASSWD: ALL' + dest: /etc/sudoers.d/phd + owner: root + group: root + mode: 0640 diff --git a/playbooks/redhat/update-all-dnf.yml b/playbooks/redhat/update-all-dnf.yml new file mode 100644 index 0000000..fee790a --- /dev/null +++ b/playbooks/redhat/update-all-dnf.yml @@ -0,0 +1,10 @@ +- name: Update RPM systems with dnf + hosts: "{{ hosts | default('all') }}" + become: yes + gather_facts: false + tasks: + - name: Update system using dnf + dnf: + name: "*" + state: latest + update_cache: yes diff --git a/playbooks/redhat/update-root.yml b/playbooks/redhat/update-root.yml new file mode 100644 index 0000000..1deda04 --- /dev/null +++ b/playbooks/redhat/update-root.yml @@ -0,0 +1,42 @@ +- name: "Update ~root from ~phd" + hosts: "{{ hosts | default('all') }}" + become: yes + gather_facts: false + tasks: + - name: "Update ~root - sync directories from ~phd" + synchronize: + src: "~phd/{{ item }}" + dest: ~root + archive: no # avoid setting owner/group + recursive: yes + links: yes + times: yes + delegate_to: "{{ inventory_hostname }}" + loop: ['.vim', 'bin', 'lib'] + + - name: "Update ~root - sync files from ~phd" + copy: + src: "~phd/{{ item }}" + remote_src: yes + dest: ~root + owner: root + group: root + mode: "0600" + force: no + loop: ['.bashrc', 'admin/home/root/.profile', + '.bash_logout', '.inputrc', '.less', '.lesskey', + '.screenrc', '.shellrc', '.tmux.conf', '.vimrc', + ] + + - name: "Update root mc - overwrite files from ~phd/admin" + become: true + copy: + src: "~phd/admin/home/root/.mc/{{ item }}" + remote_src: yes + dest: ~root/.mc + owner: root + group: root + mode: "0600" + force: no + loop: ['hotlist', 'ini', 'panels.ini'] + diff --git a/vbox-inventory b/vbox-inventory index 1383329..6d49280 100644 --- a/vbox-inventory +++ b/vbox-inventory @@ -1,2 +1,3 @@ -vbox9 ansible_host=localhost ansible_port=2022 debian_distr=stretch debian_mirror=http://mirror.yandex.ru/debian -vbox10 ansible_host=localhost ansible_port=2022 debian_distr=buster debian_mirror=https://mirror.yandex.ru/debian +vbox-d9 ansible_host=localhost ansible_port=2022 debian_distr=stretch debian_mirror=http://mirror.yandex.ru/debian +vbox-d10 ansible_host=localhost ansible_port=2022 debian_distr=buster debian_mirror=https://mirror.yandex.ru/debian +vbox-f30-64 ansible_host=localhost ansible_port=2022