WIP: Various cleanups
#83
Draft
jeltz
wants to merge 9 commits from cleanup_no_ldap_for_servers into master
@ -1,20 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Grab valid unique hostnames from the Ansible inventory.
|
||||
HOSTS=$(grep -ve '^[#\[]' hosts \
|
||||
| grep -F adm.auro.re \
|
||||
| sort -u)
|
||||
|
||||
# Ask password
|
||||
read -s -p "Hello adventurer, what is your LDAP password? " passwd
|
||||
echo
|
||||
|
||||
for host in $HOSTS; do
|
||||
echo "[+] Handling host $host"
|
||||
|
||||
# sshpass can be used for non-interactive password authentication.
|
||||
# place your password in ldap-password.txt.
|
||||
SSHPASS=${passwd} sshpass -v -e ssh-copy-id "$host"
|
||||
done
|
||||
|
||||
@ -1,10 +1,16 @@
|
||||
#!/usr/bin/env ansible-playbook
|
||||
---
|
||||
# Put a common configuration on all servers
|
||||
- hosts: all,!unifi
|
||||
vars:
|
||||
locales_default: en_US.UTF-8
|
||||
locales_additional:
|
||||
- fr_FR.UTF-8
|
||||
apt_upgrade_email_address: monitoring.aurore@lists.crans.org
|
||||
roles:
|
||||
- baseconfig
|
||||
- debian_common
|
||||
- apt_common
|
||||
- locales
|
||||
- basesecurity
|
||||
- ldap_client
|
||||
- logrotate
|
||||
- update_motd
|
||||
...
|
||||
|
||||
@ -1,21 +1,19 @@
|
||||
---
|
||||
- name: Install unattended-upgrades
|
||||
when: ansible_os_family == "Debian"
|
||||
apt:
|
||||
name: unattended-upgrades
|
||||
state: present
|
||||
update_cache: true
|
||||
register: apt_result
|
||||
retries: 3
|
||||
until: apt_result is succeeded
|
||||
|
||||
- name: Configure unattended-upgrades
|
||||
template:
|
||||
src: "apt/{{ item }}.j2"
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/apt/apt.conf.d/{{ item }}"
|
||||
owner: root
|
||||
mode: u=rw,g=r,o=r
|
||||
loop:
|
||||
- 50unattended-upgrades
|
||||
- 20auto-upgrades
|
||||
- 50unattended-upgrades
|
||||
|
||||
- name: Install debsums
|
||||
apt:
|
||||
name: debsums
|
||||
...
|
||||
@ -1,4 +1,4 @@
|
||||
// {{ ansible_managed }}
|
||||
{{ ansible_managed | comment("c") }}
|
||||
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,326 +0,0 @@
|
||||
# Filename: /etc/skel/.zshrc
|
||||
# Purpose: config file for zsh (z shell)
|
||||
# Authors: (c) grml-team (grml.org)
|
||||
# Bug-Reports: see http://grml.org/bugs/
|
||||
# License: This file is licensed under the GPL v2 or any later version.
|
||||
################################################################################
|
||||
# Nowadays, grml's zsh setup lives in only *one* zshrc file.
|
||||
# That is the global one: /etc/zsh/zshrc (from grml-etc-core).
|
||||
# It is best to leave *this* file untouched and do personal changes to
|
||||
# your zsh setup via ${HOME}/.zshrc.local which is loaded at the end of
|
||||
# the global zshrc.
|
||||
#
|
||||
# That way, we enable people on other operating systems to use our
|
||||
# setup, too, just by copying our global zshrc to their ${HOME}/.zshrc.
|
||||
# Adjustments would still go to the .zshrc.local file.
|
||||
################################################################################
|
||||
|
||||
## Aurore host color and white user
|
||||
zstyle ':prompt:grml:left:items:host' pre '%B%F{red}'
|
||||
zstyle ':prompt:grml:left:items:host' post '%f%b'
|
||||
zstyle ':prompt:grml:left:items:user' pre '%B'
|
||||
zstyle ':prompt:grml:left:items:user' post '%b'
|
||||
|
||||
## Settings for umask
|
||||
#if (( EUID == 0 )); then
|
||||
# umask 002
|
||||
#else
|
||||
# umask 022
|
||||
#fi
|
||||
|
||||
## Now, we'll give a few examples of what you might want to use in your
|
||||
## .zshrc.local file (just copy'n'paste and uncomment it there):
|
||||
|
||||
## Prompt theme extension ##
|
||||
|
||||
# Virtualenv support
|
||||
|
||||
#function virtual_env_prompt () {
|
||||
# REPLY=${VIRTUAL_ENV+(${VIRTUAL_ENV:t}) }
|
||||
#}
|
||||
#grml_theme_add_token virtual-env -f virtual_env_prompt '%F{magenta}' '%f'
|
||||
#zstyle ':prompt:grml:left:setup' items rc virtual-env change-root user at host path vcs percent
|
||||
|
||||
## ZLE tweaks ##
|
||||
|
||||
## use the vi navigation keys (hjkl) besides cursor keys in menu completion
|
||||
#bindkey -M menuselect 'h' vi-backward-char # left
|
||||
#bindkey -M menuselect 'k' vi-up-line-or-history # up
|
||||
#bindkey -M menuselect 'l' vi-forward-char # right
|
||||
#bindkey -M menuselect 'j' vi-down-line-or-history # bottom
|
||||
|
||||
## set command prediction from history, see 'man 1 zshcontrib'
|
||||
#is4 && zrcautoload predict-on && \
|
||||
#zle -N predict-on && \
|
||||
#zle -N predict-off && \
|
||||
#bindkey "^X^Z" predict-on && \
|
||||
#bindkey "^Z" predict-off
|
||||
|
||||
## press ctrl-q to quote line:
|
||||
#mquote () {
|
||||
# zle beginning-of-line
|
||||
# zle forward-word
|
||||
# # RBUFFER="'$RBUFFER'"
|
||||
# RBUFFER=${(q)RBUFFER}
|
||||
# zle end-of-line
|
||||
#}
|
||||
#zle -N mquote && bindkey '^q' mquote
|
||||
|
||||
## define word separators (for stuff like backward-word, forward-word, backward-kill-word,..)
|
||||
#WORDCHARS='*?_-.[]~=/&;!#$%^(){}<>' # the default
|
||||
#WORDCHARS=.
|
||||
#WORDCHARS='*?_[]~=&;!#$%^(){}'
|
||||
#WORDCHARS='${WORDCHARS:s@/@}'
|
||||
|
||||
# just type '...' to get '../..'
|
||||
#rationalise-dot() {
|
||||
#local MATCH
|
||||
#if [[ $LBUFFER =~ '(^|/| | |'$'\n''|\||;|&)\.\.$' ]]; then
|
||||
# LBUFFER+=/
|
||||
# zle self-insert
|
||||
# zle self-insert
|
||||
#else
|
||||
# zle self-insert
|
||||
#fi
|
||||
#}
|
||||
#zle -N rationalise-dot
|
||||
#bindkey . rationalise-dot
|
||||
## without this, typing a . aborts incremental history search
|
||||
#bindkey -M isearch . self-insert
|
||||
|
||||
#bindkey '\eq' push-line-or-edit
|
||||
|
||||
## some popular options ##
|
||||
|
||||
## add `|' to output redirections in the history
|
||||
#setopt histallowclobber
|
||||
|
||||
## try to avoid the 'zsh: no matches found...'
|
||||
#setopt nonomatch
|
||||
|
||||
## warning if file exists ('cat /dev/null > ~/.zshrc')
|
||||
#setopt NO_clobber
|
||||
|
||||
## don't warn me about bg processes when exiting
|
||||
#setopt nocheckjobs
|
||||
|
||||
## alert me if something failed
|
||||
#setopt printexitvalue
|
||||
|
||||
## with spelling correction, assume dvorak kb
|
||||
#setopt dvorak
|
||||
|
||||
## Allow comments even in interactive shells
|
||||
#setopt interactivecomments
|
||||
|
||||
|
||||
## compsys related snippets ##
|
||||
|
||||
## changed completer settings
|
||||
#zstyle ':completion:*' completer _complete _correct _approximate
|
||||
#zstyle ':completion:*' expand prefix suffix
|
||||
|
||||
## another different completer setting: expand shell aliases
|
||||
#zstyle ':completion:*' completer _expand_alias _complete _approximate
|
||||
|
||||
## to have more convenient account completion, specify your logins:
|
||||
#my_accounts=(
|
||||
# {grml,grml1}@foo.invalid
|
||||
# grml-devel@bar.invalid
|
||||
#)
|
||||
#other_accounts=(
|
||||
# {fred,root}@foo.invalid
|
||||
# vera@bar.invalid
|
||||
#)
|
||||
#zstyle ':completion:*:my-accounts' users-hosts $my_accounts
|
||||
#zstyle ':completion:*:other-accounts' users-hosts $other_accounts
|
||||
|
||||
## add grml.org to your list of hosts
|
||||
#hosts+=(grml.org)
|
||||
#zstyle ':completion:*:hosts' hosts $hosts
|
||||
|
||||
## telnet on non-default ports? ...well:
|
||||
## specify specific port/service settings:
|
||||
#telnet_users_hosts_ports=(
|
||||
# user1@host1:
|
||||
# user2@host2:
|
||||
# @mail-server:{smtp,pop3}
|
||||
# @news-server:nntp
|
||||
# @proxy-server:8000
|
||||
#)
|
||||
#zstyle ':completion:*:*:telnet:*' users-hosts-ports $telnet_users_hosts_ports
|
||||
|
||||
## the default grml setup provides '..' as a completion. it does not provide
|
||||
## '.' though. If you want that too, use the following line:
|
||||
#zstyle ':completion:*' special-dirs true
|
||||
|
||||
## aliases ##
|
||||
|
||||
## translate
|
||||
#alias u='translate -i'
|
||||
|
||||
## ignore ~/.ssh/known_hosts entries
|
||||
#alias insecssh='ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" -o "PreferredAuthentications=keyboard-interactive"'
|
||||
|
||||
|
||||
## global aliases (for those who like them) ##
|
||||
|
||||
#alias -g '...'='../..'
|
||||
#alias -g '....'='../../..'
|
||||
#alias -g BG='& exit'
|
||||
#alias -g C='|wc -l'
|
||||
#alias -g G='|grep'
|
||||
#alias -g H='|head'
|
||||
#alias -g Hl=' --help |& less -r'
|
||||
#alias -g K='|keep'
|
||||
#alias -g L='|less'
|
||||
#alias -g LL='|& less -r'
|
||||
#alias -g M='|most'
|
||||
#alias -g N='&>/dev/null'
|
||||
#alias -g R='| tr A-z N-za-m'
|
||||
#alias -g SL='| sort | less'
|
||||
#alias -g S='| sort'
|
||||
#alias -g T='|tail'
|
||||
#alias -g V='| vim -'
|
||||
|
||||
## instead of global aliase it might be better to use grmls $abk assoc array, whose contents are expanded after pressing ,.
|
||||
#$abk[SnL]="| sort -n | less"
|
||||
|
||||
## get top 10 shell commands:
|
||||
#alias top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'
|
||||
|
||||
## Execute \kbd{./configure}
|
||||
#alias CO="./configure"
|
||||
|
||||
## Execute \kbd{./configure --help}
|
||||
#alias CH="./configure --help"
|
||||
|
||||
## miscellaneous code ##
|
||||
|
||||
## Use a default width of 80 for manpages for more convenient reading
|
||||
#export MANWIDTH=${MANWIDTH:-80}
|
||||
|
||||
## Set a search path for the cd builtin
|
||||
#cdpath=(.. ~)
|
||||
|
||||
## variation of our manzsh() function; pick you poison:
|
||||
#manzsh() { /usr/bin/man zshall | most +/"$1" ; }
|
||||
|
||||
## Switching shell safely and efficiently? http://www.zsh.org/mla/workers/2001/msg02410.html
|
||||
#bash() {
|
||||
# NO_SWITCH="yes" command bash "$@"
|
||||
#}
|
||||
#restart () {
|
||||
# exec $SHELL $SHELL_ARGS "$@"
|
||||
#}
|
||||
|
||||
## Handy functions for use with the (e::) globbing qualifier (like nt)
|
||||
#contains() { grep -q "$*" $REPLY }
|
||||
#sameas() { diff -q "$*" $REPLY &>/dev/null }
|
||||
#ot () { [[ $REPLY -ot ${~1} ]] }
|
||||
|
||||
## get_ic() - queries imap servers for capabilities; real simple. no imaps
|
||||
#ic_get() {
|
||||
# emulate -L zsh
|
||||
# local port
|
||||
# if [[ ! -z $1 ]] ; then
|
||||
# port=${2:-143}
|
||||
# print "querying imap server on $1:${port}...\n";
|
||||
# print "a1 capability\na2 logout\n" | nc $1 ${port}
|
||||
# else
|
||||
# print "usage:\n $0 <imap-server> [port]"
|
||||
# fi
|
||||
#}
|
||||
|
||||
## List all occurrences of programm in current PATH
|
||||
#plap() {
|
||||
# emulate -L zsh
|
||||
# if [[ $# = 0 ]] ; then
|
||||
# echo "Usage: $0 program"
|
||||
# echo "Example: $0 zsh"
|
||||
# echo "Lists all occurrences of program in the current PATH."
|
||||
# else
|
||||
# ls -l ${^path}/*$1*(*N)
|
||||
# fi
|
||||
#}
|
||||
|
||||
## Find out which libs define a symbol
|
||||
#lcheck() {
|
||||
# if [[ -n "$1" ]] ; then
|
||||
# nm -go /usr/lib/lib*.a 2>/dev/null | grep ":[[:xdigit:]]\{8\} . .*$1"
|
||||
# else
|
||||
# echo "Usage: lcheck <function>" >&2
|
||||
# fi
|
||||
#}
|
||||
|
||||
## Download a file and display it locally
|
||||
#uopen() {
|
||||
# emulate -L zsh
|
||||
# if ! [[ -n "$1" ]] ; then
|
||||
# print "Usage: uopen \$URL/\$file">&2
|
||||
# return 1
|
||||
# else
|
||||
# FILE=$1
|
||||
# MIME=$(curl --head $FILE | \
|
||||
# grep Content-Type | \
|
||||
# cut -d ' ' -f 2 | \
|
||||
# cut -d\; -f 1)
|
||||
# MIME=${MIME%$'\r'}
|
||||
# curl $FILE | see ${MIME}:-
|
||||
# fi
|
||||
#}
|
||||
|
||||
## Memory overview
|
||||
#memusage() {
|
||||
# ps aux | awk '{if (NR > 1) print $5;
|
||||
# if (NR > 2) print "+"}
|
||||
# END { print "p" }' | dc
|
||||
#}
|
||||
|
||||
## print hex value of a number
|
||||
#hex() {
|
||||
# emulate -L zsh
|
||||
# if [[ -n "$1" ]]; then
|
||||
# printf "%x\n" $1
|
||||
# else
|
||||
# print 'Usage: hex <number-to-convert>'
|
||||
# return 1
|
||||
# fi
|
||||
#}
|
||||
|
||||
## log out? set timeout in seconds...
|
||||
## ...and do not log out in some specific terminals:
|
||||
#if [[ "${TERM}" == ([Exa]term*|rxvt|dtterm|screen*) ]] ; then
|
||||
# unset TMOUT
|
||||
#else
|
||||
# TMOUT=1800
|
||||
#fi
|
||||
|
||||
## associate types and extensions (be aware with perl scripts and anwanted behaviour!)
|
||||
#check_com zsh-mime-setup || { autoload zsh-mime-setup && zsh-mime-setup }
|
||||
#alias -s pl='perl -S'
|
||||
|
||||
## ctrl-s will no longer freeze the terminal.
|
||||
#stty erase "^?"
|
||||
|
||||
## you want to automatically use a bigger font on big terminals?
|
||||
#if [[ "$TERM" == "xterm" ]] && [[ "$LINES" -ge 50 ]] && [[ "$COLUMNS" -ge 100 ]] && [[ -z "$SSH_CONNECTION" ]] ; then
|
||||
# large
|
||||
#fi
|
||||
|
||||
## Some quick Perl-hacks aka /useful/ oneliner
|
||||
#bew() { perl -le 'print unpack "B*","'$1'"' }
|
||||
#web() { perl -le 'print pack "B*","'$1'"' }
|
||||
#hew() { perl -le 'print unpack "H*","'$1'"' }
|
||||
#weh() { perl -le 'print pack "H*","'$1'"' }
|
||||
#pversion() { perl -M$1 -le "print $1->VERSION" } # i. e."pversion LWP -> 5.79"
|
||||
#getlinks () { perl -ne 'while ( m/"((www|ftp|http):\/\/.*?)"/gc ) { print $1, "\n"; }' $* }
|
||||
#gethrefs () { perl -ne 'while ( m/href="([^"]*)"/gc ) { print $1, "\n"; }' $* }
|
||||
#getanames () { perl -ne 'while ( m/a name="([^"]*)"/gc ) { print $1, "\n"; }' $* }
|
||||
#getforms () { perl -ne 'while ( m:(\</?(input|form|select|option).*?\>):gic ) { print $1, "\n"; }' $* }
|
||||
#getstrings () { perl -ne 'while ( m/"(.*?)"/gc ) { print $1, "\n"; }' $*}
|
||||
#showINC () { perl -e 'for (@INC) { printf "%d %s\n", $i++, $_ }' }
|
||||
#vimpm () { vim `perldoc -l $1 | sed -e 's/pod$/pm/'` }
|
||||
#vimhelp () { vim -c "help $1" -c on -c "au! VimEnter *" }
|
||||
|
||||
## END OF FILE #################################################################
|
||||
@ -1,32 +0,0 @@
|
||||
---
|
||||
# Install apt-listchanges
|
||||
- name: Install apt-listchanges
|
||||
when: ansible_os_family == "Debian"
|
||||
apt:
|
||||
name: apt-listchanges
|
||||
state: present
|
||||
update_cache: true
|
||||
register: apt_result
|
||||
retries: 3
|
||||
until: apt_result is succeeded
|
||||
|
||||
# Send email when there is something new
|
||||
- name: Configure apt-listchanges
|
||||
ini_file:
|
||||
path: /etc/apt/listchanges.conf
|
||||
no_extra_spaces: true
|
||||
section: apt
|
||||
option: "{{ item.option }}"
|
||||
value: "{{ item.value }}"
|
||||
state: present
|
||||
mode: 0644
|
||||
loop:
|
||||
- option: confirm
|
||||
value: "true"
|
||||
|
||||
- option: email_address
|
||||
value: "{{ monitoring_mail }}"
|
||||
|
||||
- option: which
|
||||
value: both
|
||||
...
|
||||
@ -1,10 +0,0 @@
|
||||
---
|
||||
- name: Restart sshd service
|
||||
service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Restart fail2ban service
|
||||
service:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
@ -0,0 +1,4 @@
|
||||
---
|
||||
locales_default: en_US.UTF-8
|
||||
locales_additional: []
|
||||
...
|
||||
@ -1,4 +1,4 @@
|
||||
---
|
||||
# Reconfigure locales when conf changes
|
||||
- name: Reconfigure locales
|
||||
command: dpkg-reconfigure locales -f noninteractive
|
||||
...
|
||||
@ -0,0 +1,15 @@
|
||||
---
|
||||
- name: Install locales
|
||||
locale_gen:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop: "{{ [locales_default] + locales_additional }}"
|
||||
|
||||
- name: Select default locale
|
||||
debconf:
|
||||
name: locales
|
||||
question: locales/default_environment_locale
|
||||
value: "{{ locales_default }}"
|
||||
vtype: select
|
||||
notify: Reconfigure locales
|
||||
...
|
||||
@ -1,4 +1,7 @@
|
||||
---
|
||||
openssh_authorized_principals:
|
||||
- any
|
||||
openssh_allow_passwords: false
|
||||
openssh_whitelist_users: []
|
||||
openssh_whitelist_groups: []
|
||||
...
|
||||
|
||||
@ -0,0 +1,5 @@
|
||||
---
|
||||
- name: Install qemu-guest-agent
|
||||
apt:
|
||||
name: qemu-guest-agent
|
||||
...
|
||||
@ -0,0 +1,17 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
[global]
|
||||
logfile="syslog"
|
||||
loglevel=3
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inpflow_NFCT.so"
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IP2STR.so"
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_PRINTFLOW.so"
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_SYSLOG.so"
|
||||
stack=ct:NFCT,ip2str:IP2STR,print:PRINTFLOW,sys:SYSLOG
|
||||
|
||||
[ct]
|
||||
#reliable=1
|
||||
hash_enable=0
|
||||
|
||||
[sys]
|
||||
facility=LOG_LOCAL2
|
||||
Loading…
Reference in New Issue