35 lines
1.7 KiB
YAML
Executable File
35 lines
1.7 KiB
YAML
Executable File
---
|
|
# ---------------------------------------------------
|
|
# configuration Linux : Sécurisation
|
|
# ---------------------------------------------------
|
|
- name: Ajout du soft reboot
|
|
lineinfile: dest=/etc/rc.local state=present line='/sbin/ctrlaltdel soft'
|
|
tags: softreboot
|
|
|
|
- name: Sécurisation du vidage mémoire
|
|
copy: src="00-vidage.conf" dest="/etc/security/limits.d/00-vidage.conf"
|
|
|
|
- name: Application des paramètres de configuration sécurisée
|
|
sysctl: name="{{ item.name }}" value="{{ item.value }}" state=present reload=yes ignoreerrors=yes
|
|
when: secure_configuration
|
|
with_items:
|
|
- { name: net.ipv4.conf.all.accept_redirects, value: 0 }
|
|
- { name: net.ipv4.conf.default.accept_redirects, value: 0 }
|
|
- { name: net.ipv4.conf.all.secure_redirects, value: 0 }
|
|
- { name: net.ipv4.conf.default.secure_redirects, value: 0 }
|
|
- { name: net.ipv4.ip_forward, value: 0 }
|
|
- { name: net.ipv6.conf.all.accept_redirects, value: 0 }
|
|
- { name: net.ipv6.conf.default.accept_redirects, value: 0 }
|
|
- { name: net.ipv4.conf.default.accept_source_route, value: 0 }
|
|
- { name: net.ipv4.conf.all.accept_source_route, value: 0 }
|
|
- { name: net.ipv6.conf.default.accept_source_route, value: 0 }
|
|
- { name: net.ipv6.conf.all.accept_source_route, value: 0 }
|
|
- { name: net.ipv4.conf.all.log_martians, value: 1 }
|
|
- { name: net.ipv4.conf.default.log_martians, value: 1 }
|
|
- { name: net.ipv4.icmp_echo_ignore_broadcasts, value: 1 }
|
|
- { name: net.ipv4.icmp_ignore_bogus_error_responses, value: 1 }
|
|
- { name: net.ipv6.conf.all.accept_ra, value: 0 }
|
|
- { name: net.ipv6.conf.default.accept_ra, value: 0 }
|
|
tags: secure_config
|
|
|