2019-03-11 14:52:03 +01:00
|
|
|
---
|
|
|
|
|
- name: Configure sysctl
|
|
|
|
|
template:
|
2019-03-14 15:45:19 +01:00
|
|
|
src: sysctl.d/local.conf.j2
|
|
|
|
|
dest: /etc/sysctl.d/local.conf
|
2019-03-11 14:52:03 +01:00
|
|
|
mode: 0644
|
|
|
|
|
|
|
|
|
|
# Use this command to list setuid or setgid executables
|
|
|
|
|
# find / -type f -perm /6000 -ls 2>/dev/null
|
|
|
|
|
- name: Desactivate setuid/setgid on unused binaries
|
|
|
|
|
file:
|
|
|
|
|
path: "{{ item }}"
|
|
|
|
|
mode: u-s,g-s
|
|
|
|
|
loop:
|
|
|
|
|
- /usr/lib/openssh/sshkeysign # Not used
|
|
|
|
|
- /usr/bin/gpasswd # No group auth
|
|
|
|
|
- /usr/bin/passwd # Only root should change passwd
|
|
|
|
|
- /usr/bin/expiry # With re2o
|
|
|
|
|
- /usr/bin/newgrp # No group auth
|
|
|
|
|
- /usr/bin/chage # With re2o
|
|
|
|
|
- /usr/bin/chsh # With re2o
|
|
|
|
|
- /usr/bin/chfn # With re2o
|
|
|
|
|
- /bin/mount # Only root should mount
|
|
|
|
|
- /bin/umount # Only root should umount
|
2019-03-12 17:04:06 +01:00
|
|
|
ignore_errors: true # Sometimes file won't exist
|
2019-03-14 15:45:19 +01:00
|
|
|
|
2019-03-16 22:06:50 +01:00
|
|
|
# See altered packages and configurations with `debsums -ca`
|
|
|
|
|
- name: Install debsums
|
|
|
|
|
apt:
|
|
|
|
|
name: debsums
|
2019-03-23 19:25:04 +01:00
|
|
|
state: present
|
2019-03-16 22:06:50 +01:00
|
|
|
register: apt_result
|
|
|
|
|
retries: 3
|
|
|
|
|
until: apt_result is succeeded
|
