initial commit

inventories/production/group_vars/all.yml

@@ -0,0 +1,156 @@
+---
+# Global variables for all managed Linux servers.
+# Replace placeholder values (domain, hosts, URLs) before rollout.
+
+# base_os
+# Base package lists and unwanted-package lists are OS-family-specific
+# (see roles/base_os/vars/RedHat.yml and roles/base_os/vars/Debian.yml).
+# Use base_extra_packages for additions that apply across all hosts.
+timezone: "Europe/Berlin"
+ntp_servers:
+  - "0.de.pool.ntp.org"
+  - "1.de.pool.ntp.org"
+base_extra_packages: []
+base_unneeded_services:
+  - avahi-daemon
+  - cups
+  - rpcbind
+  - bluetooth
+
+# repo_management
+repo_mgmt_check_internet: true
+repo_mgmt_internet_check_url: "https://dl.rockylinux.org"
+# RedHat family
+epel_enabled: false
+epel_major_version: "9"
+crb_enabled: true
+custom_yum_repos: []
+# custom_yum_repos:
+#   - name: "internal"
+#     description: "Internal repository"
+#     baseurl: "https://repo.example.corp/rocky9/internal/"
+#     gpgcheck: true
+#     gpgkey: "https://repo.example.corp/RPM-GPG-KEY-internal"
+# Debian family
+ubuntu_universe_enabled: false
+debian_backports_enabled: false
+custom_apt_repos: []
+# custom_apt_repos:
+#   - name: "internal"
+#     uris: "https://repo.example.corp/ubuntu"
+#     suites: "{{ ansible_facts['distribution_release'] }}"
+#     components: ["main"]
+#     signed_by: "https://repo.example.corp/gpg"
+
+# identity_ad
+ad_domain: "example.corp"
+ad_domain_realm: "EXAMPLE.CORP"
+ad_ou: "OU=LinuxServers,DC=example,DC=corp"
+ad_admin_group: "GG_Linux_Admins"
+ad_operator_group: "GG_Linux_Operators"
+sssd_use_fully_qualified_names: false
+
+# sudo_rbac
+sudo_rbac_rules:
+  - group: "{{ ad_admin_group }}"
+    commands: "ALL"
+    nopasswd: false
+  - group: "{{ ad_operator_group }}"
+    commands: "/usr/bin/systemctl restart *, /usr/bin/systemctl status *, /usr/bin/journalctl *"
+    nopasswd: false
+
+# local_accounts
+breakglass_username: "bglocal_admin"
+breakglass_comment: "Local emergency (break-glass) account"
+local_service_accounts: []
+
+# ssh_hardening
+ssh_allow_groups: "linux_admins linux_operators"
+ssh_port: 22
+ssh_max_auth_tries: 3
+ssh_client_alive_interval: 300
+ssh_client_alive_count_max: 2
+
+# pam_hardening
+pam_pwquality_minlen: 14
+pam_pwquality_dcredit: -1
+pam_pwquality_ucredit: -1
+pam_pwquality_lcredit: -1
+pam_pwquality_ocredit: -1
+pam_pwquality_retry: 3
+pam_faillock_deny: 5
+pam_faillock_unlock_time: 900
+
+# fail2ban
+fail2ban_bantime: 3600
+fail2ban_findtime: 600
+fail2ban_maxretry: 5
+fail2ban_ignoreip: "127.0.0.1/8 ::1 {{ firewall_admin_subnet }}"
+
+# banners
+banner_enabled: true
+
+# cis_hardening
+cis_level: 1   # raised to 2 in group_vars/dmz.yml
+cis_disable_filesystems:
+  - cramfs
+  - freevxfs
+  - jffs2
+  - hfs
+  - hfsplus
+  - udf
+cis_disable_modules_level2:
+  - usb-storage
+  - bluetooth
+  - firewire-core
+cis_shell_tmout_seconds: 900
+cis_umask: "027"
+cis_disable_ctrl_alt_del: true
+cis_sticky_bit_enforce: true
+cis_journald_persistent: true
+cis_journald_max_use: "500M"
+cis_boot_hardening_enabled: false   # requires reboot to take effect, verify manually first
+cis_unowned_files_report_enabled: true
+cis_unowned_files_report_cron_hour: 4
+cis_grub_password_enabled: false
+grub_bootloader_username: "grubadmin"
+grub_bootloader_is_uefi: false
+
+# selinux_config
+selinux_state: enforcing
+selinux_policy: targeted
+
+# firewall_config
+firewall_default_zone: "drop"
+firewall_admin_subnet: "10.10.5.0/24"
+firewall_allowed_services: []
+firewall_log_denied: "unicast"
+
+# falcon_onboarding
+falcon_onboarding_cloud_region: "eu-1"
+# falcon_onboarding_sensor_package_url / falcon_onboarding_sensor_package_src
+# and falcon_cid are set per environment / in vault/secrets.yml
+
+# logging_rsyslog
+syslog_collector_host: "siem.example.corp"
+syslog_collector_port: 6514
+syslog_use_tls: true
+syslog_ca_cert_enabled: false
+syslog_ca_cert_src: "siem-ca.crt"   # relative to roles/logging_rsyslog/files/
+
+# aide_integrity
+aide_check_cron_hour: 5
+aide_check_cron_minute: 0
+aide_notify_email: "root"
+
+# patch_mgmt
+dnf_automatic_apply_security: true
+dnf_automatic_apply_other: false
+patch_reboot_window_hosts: []
+patch_reboot_day: "sun"
+patch_reboot_time: "03:00"
+
+# backup_agent
+veeam_agent_enabled: false
+# veeam_agent_repo_url (RedHat family) / veeam_agent_apt_repo_line (Debian family)
+# are set per environment, see roles/backup_agent/defaults/main.yml

inventories/production/group_vars/dmz.yml

@@ -0,0 +1,12 @@
+---
+# Overrides for the "dmz" group (see hosts.ini).
+
+cis_level: 2
+
+firewall_allowed_services:
+  - service: "https"
+    source: "any"
+  - service: "ssh"
+    source: "{{ firewall_admin_subnet }}"
+
+firewall_default_zone: "drop"