You've already forked ansible-linux-infra
initial commit
This commit is contained in:
Riedel
156
inventories/production/group_vars/all.yml
Normal file
156
inventories/production/group_vars/all.yml
Normal file
@@ -0,0 +1,156 @@
|
||||
---
|
||||
# Global variables for all managed Linux servers.
|
||||
# Replace placeholder values (domain, hosts, URLs) before rollout.
|
||||
|
||||
# base_os
|
||||
# Base package lists and unwanted-package lists are OS-family-specific
|
||||
# (see roles/base_os/vars/RedHat.yml and roles/base_os/vars/Debian.yml).
|
||||
# Use base_extra_packages for additions that apply across all hosts.
|
||||
timezone: "Europe/Berlin"
|
||||
ntp_servers:
|
||||
- "0.de.pool.ntp.org"
|
||||
- "1.de.pool.ntp.org"
|
||||
base_extra_packages: []
|
||||
base_unneeded_services:
|
||||
- avahi-daemon
|
||||
- cups
|
||||
- rpcbind
|
||||
- bluetooth
|
||||
|
||||
# repo_management
|
||||
repo_mgmt_check_internet: true
|
||||
repo_mgmt_internet_check_url: "https://dl.rockylinux.org"
|
||||
# RedHat family
|
||||
epel_enabled: false
|
||||
epel_major_version: "9"
|
||||
crb_enabled: true
|
||||
custom_yum_repos: []
|
||||
# custom_yum_repos:
|
||||
# - name: "internal"
|
||||
# description: "Internal repository"
|
||||
# baseurl: "https://repo.example.corp/rocky9/internal/"
|
||||
# gpgcheck: true
|
||||
# gpgkey: "https://repo.example.corp/RPM-GPG-KEY-internal"
|
||||
# Debian family
|
||||
ubuntu_universe_enabled: false
|
||||
debian_backports_enabled: false
|
||||
custom_apt_repos: []
|
||||
# custom_apt_repos:
|
||||
# - name: "internal"
|
||||
# uris: "https://repo.example.corp/ubuntu"
|
||||
# suites: "{{ ansible_facts['distribution_release'] }}"
|
||||
# components: ["main"]
|
||||
# signed_by: "https://repo.example.corp/gpg"
|
||||
|
||||
# identity_ad
|
||||
ad_domain: "example.corp"
|
||||
ad_domain_realm: "EXAMPLE.CORP"
|
||||
ad_ou: "OU=LinuxServers,DC=example,DC=corp"
|
||||
ad_admin_group: "GG_Linux_Admins"
|
||||
ad_operator_group: "GG_Linux_Operators"
|
||||
sssd_use_fully_qualified_names: false
|
||||
|
||||
# sudo_rbac
|
||||
sudo_rbac_rules:
|
||||
- group: "{{ ad_admin_group }}"
|
||||
commands: "ALL"
|
||||
nopasswd: false
|
||||
- group: "{{ ad_operator_group }}"
|
||||
commands: "/usr/bin/systemctl restart *, /usr/bin/systemctl status *, /usr/bin/journalctl *"
|
||||
nopasswd: false
|
||||
|
||||
# local_accounts
|
||||
breakglass_username: "bglocal_admin"
|
||||
breakglass_comment: "Local emergency (break-glass) account"
|
||||
local_service_accounts: []
|
||||
|
||||
# ssh_hardening
|
||||
ssh_allow_groups: "linux_admins linux_operators"
|
||||
ssh_port: 22
|
||||
ssh_max_auth_tries: 3
|
||||
ssh_client_alive_interval: 300
|
||||
ssh_client_alive_count_max: 2
|
||||
|
||||
# pam_hardening
|
||||
pam_pwquality_minlen: 14
|
||||
pam_pwquality_dcredit: -1
|
||||
pam_pwquality_ucredit: -1
|
||||
pam_pwquality_lcredit: -1
|
||||
pam_pwquality_ocredit: -1
|
||||
pam_pwquality_retry: 3
|
||||
pam_faillock_deny: 5
|
||||
pam_faillock_unlock_time: 900
|
||||
|
||||
# fail2ban
|
||||
fail2ban_bantime: 3600
|
||||
fail2ban_findtime: 600
|
||||
fail2ban_maxretry: 5
|
||||
fail2ban_ignoreip: "127.0.0.1/8 ::1 {{ firewall_admin_subnet }}"
|
||||
|
||||
# banners
|
||||
banner_enabled: true
|
||||
|
||||
# cis_hardening
|
||||
cis_level: 1 # raised to 2 in group_vars/dmz.yml
|
||||
cis_disable_filesystems:
|
||||
- cramfs
|
||||
- freevxfs
|
||||
- jffs2
|
||||
- hfs
|
||||
- hfsplus
|
||||
- udf
|
||||
cis_disable_modules_level2:
|
||||
- usb-storage
|
||||
- bluetooth
|
||||
- firewire-core
|
||||
cis_shell_tmout_seconds: 900
|
||||
cis_umask: "027"
|
||||
cis_disable_ctrl_alt_del: true
|
||||
cis_sticky_bit_enforce: true
|
||||
cis_journald_persistent: true
|
||||
cis_journald_max_use: "500M"
|
||||
cis_boot_hardening_enabled: false # requires reboot to take effect, verify manually first
|
||||
cis_unowned_files_report_enabled: true
|
||||
cis_unowned_files_report_cron_hour: 4
|
||||
cis_grub_password_enabled: false
|
||||
grub_bootloader_username: "grubadmin"
|
||||
grub_bootloader_is_uefi: false
|
||||
|
||||
# selinux_config
|
||||
selinux_state: enforcing
|
||||
selinux_policy: targeted
|
||||
|
||||
# firewall_config
|
||||
firewall_default_zone: "drop"
|
||||
firewall_admin_subnet: "10.10.5.0/24"
|
||||
firewall_allowed_services: []
|
||||
firewall_log_denied: "unicast"
|
||||
|
||||
# falcon_onboarding
|
||||
falcon_onboarding_cloud_region: "eu-1"
|
||||
# falcon_onboarding_sensor_package_url / falcon_onboarding_sensor_package_src
|
||||
# and falcon_cid are set per environment / in vault/secrets.yml
|
||||
|
||||
# logging_rsyslog
|
||||
syslog_collector_host: "siem.example.corp"
|
||||
syslog_collector_port: 6514
|
||||
syslog_use_tls: true
|
||||
syslog_ca_cert_enabled: false
|
||||
syslog_ca_cert_src: "siem-ca.crt" # relative to roles/logging_rsyslog/files/
|
||||
|
||||
# aide_integrity
|
||||
aide_check_cron_hour: 5
|
||||
aide_check_cron_minute: 0
|
||||
aide_notify_email: "root"
|
||||
|
||||
# patch_mgmt
|
||||
dnf_automatic_apply_security: true
|
||||
dnf_automatic_apply_other: false
|
||||
patch_reboot_window_hosts: []
|
||||
patch_reboot_day: "sun"
|
||||
patch_reboot_time: "03:00"
|
||||
|
||||
# backup_agent
|
||||
veeam_agent_enabled: false
|
||||
# veeam_agent_repo_url (RedHat family) / veeam_agent_apt_repo_line (Debian family)
|
||||
# are set per environment, see roles/backup_agent/defaults/main.yml
|
||||
Reference in New Issue
Block a user