ansible-ops-management/vars/RedHat.yml
nazunalika 699ec2e2f0
init
2022-02-26 20:19:20 -07:00

163 lines
3.4 KiB
YAML

# Variables for our common module for RedHat
---
bin_su: /usr/bin/su
bin_sudo: /usr/bin/sudo
# grub variables
grub_boot_options: audit=1
grub_config_path_link: /etc/grub2.cfg
grub_config_path_efi: /etc/grub2-efi.cfg
ipatype: client
# Removing TFTP for now because there will likely be tftp/pxe servers
remove_packages:
- nc
- wireshark
- prelink
- talk
- talk-server
- rsh
- lftp
# security limits
limits:
- {domain: '*', limit_type: hard, limit_item: core, value: 0}
# sysctl settings
sysctl_config:
net.ipv4.ip_forward: 0
net.ipv4.conf.all.rp_filter: 1
net.ipv4.conf.default.rp_filter: 1
net.ipv4.conf.all.accept_source_route: 0
net.ipv4.conf.default.accept_source_route: 0
net.ipv4.conf.all.log_martians: 1
net.ipv4.conf.default.log_martians: 1
net.ipv4.icmp_echo_ignore_broadcasts: 1
net.ipv4.icmp_ignore_bogus_error_responses: 1
net.ipv4.tcp_syncookies: 1
net.ipv4.conf.all.accept_redirects: 0
net.ipv4.conf.default.accept_redirects: 0
net.ipv4.conf.all.send_redirects: 0
net.ipv4.conf.default.send_redirects: 0
net.ipv4.conf.all.secure_redirects: 0
net.ipv4.conf.default.secure_redirects: 0
net.ipv6.conf.all.accept_redirects: 0
net.ipv6.conf.default.accept_redirects: 0
net.ipv6.conf.all.forwarding: 0
net.ipv6.conf.all.accept_ra: 0
net.ipv6.conf.default.accept_ra: 0
net.ipv6.conf.all.accept_source_route: 0
net.ipv6.conf.default.accept_source_route: 0
kernel.randomize_va_space: 2
fs.suid_dumpable: 0
# login.defs
login_umask: 077
login_create_home: "yes"
login_encrypt_method: SHA512
login_md5_crypt_enab: "no"
login_max_days: 84
login_min_days: 7
login_min_len: 14
login_warn_age: 7
login_dcredit: -1
login_lcredit: -1
login_ucredit: -1
login_ocredit: -1
login_cron_directories:
- /etc/cron.hourly
- /etc/cron.daily
- /etc/cron.weekly
- /etc/cron.monthly
- /etc/cron.d
login_cron_allows:
- /etc/cron.allow
- /etc/at.allow
login_cron_denies:
- /etc/cron.deny
- /etc/at.deny
# modprobe
modprobe_unused_filesystems:
- dccp
- sctp
- bluetooth
- freevxfs
- cramfs
- jffs2
- hfs
- hfsplus
- squashfs
- udf
- tipc
- usb_storage
- vfat
# auditd
audit_package: audit
audit_auid: 1000
audit_buffer: 8192
audit_identity_list:
- /etc/group
- /etc/passwd
- /etc/gshadow
- /etc/shadow
- /etc/security/opasswd
audit_logins:
- /var/log/faillog
- /var/log/lastlog
- /var/log/tallylog
- /var/log/faillock/
- /var/log/wtmp
- /var/log/btmp
audit_session:
- /var/run/utmp
audit_suid_list:
- /usr/libexec/sssd/proxy_child
- /usr/libexec/sssd/ldap_child
- /usr/libexec/sssd/krb5_child
- /usr/libexec/sssd/selinux_child
- /usr/libexec/dbus-1/dbus-daemon-launch-helper
- /usr/libexec/utempter/utempter
- /usr/libexec/openssh/ssh-keysign
- /usr/lib/polkit-1/polkit-agent-helper-1
- /usr/sbin/usernetctl
- /usr/sbin/postqueue
- /usr/sbin/unix_chkpwd
- /usr/sbin/postdrop
- /usr/sbin/pam_timestamp_check
- /usr/sbin/netreport
- /usr/sbin/mount.nfs
- /usr/bin/su
- /usr/bin/ksu
- /usr/bin/write
- /usr/bin/newgrp
- /usr/bin/chage
- /usr/bin/mount
- /usr/bin/ssh-agent
- /usr/bin/sudo
- /usr/bin/passwd
- /usr/bin/gpasswd
- /usr/bin/at
- /usr/bin/wall
- /usr/bin/chsh
- /usr/bin/locate
- /usr/bin/chfn
- /usr/bin/umount
- /usr/bin/crontab
- /usr/bin/pkexec
disable_svc:
- cups
- nfs-server
- avahi-daemon
enable_svc:
- postfix
syslog_packages:
- rsyslog
...