evolix
/
ansible-roles
22
2
Fork 2
Code Issues 61 Pull Requests 18 Releases 32 Wiki Activity

Merge branch 'unstable' into stable

This commit is contained in:
Jérémy Lecour 2018-01-18 18:42:18 +01:00 committed by Jérémy Lecour
parent 516aafbaa4 cf8b110abb
commit 72695db53b
46 changed files with 876 additions and 194 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
CHANGELOG.md Normal file
View File

@ -0,0 +1,34 @@
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
and this project tries to adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
## [Unreleased]
## [9.1.5]
### Added
* There is changelog!
* Redis: configuration variable for protected mode (v3.2+)
* evolinux-users: users are in "adm" group for Debian 9 or later
* evolinx-base: purge locate/mlocate packages
* evolinx-base: create /etc/evolinux if missing
* many Ansible tags for easier fine grained execution of playbooks
* apache/nginx: server status suffix management
* unbound: retrieve list of root DNS servers
* redmine: ability to install thems and plugins
### Changed
* Rbenv: Ruby 2.5 becomes the default version
* evocheck: update upstream version embedded in role (c993244)
* bind: keep 52 weeks of logs
### Fixed
* squid: different logrotate file for Jessie or Stretch+
* evoacme: don't invoke evoacme if no vhost is found
* evomaintenance: explicit quotes in config file
* redmine: force xpath gem < 3.0.0
### Security
* evomaintenance: fix permissions for config file

1
apache/defaults/main.yml
View File

@ -12,6 +12,7 @@ apache_evolinux_default_ssl_cert: /etc/ssl/certs/ssl-cert-snakeoil.pem
apache_evolinux_default_ssl_key: /etc/ssl/private/ssl-cert-snakeoil.key
apache_serverstatus_suffix: ""
apache_serverstatus_suffix_file: "/etc/evolinux/apache_serverstatus_suffix"
apache_log2mail_include: True
apache_munin_include: True

14
apache/tasks/auth.yml
View File

@ -9,7 +9,7 @@
mode: "0640"
force: no
tags:
- apache
- apache
- name: add IP addresses to private IP whitelist
lineinfile:
@ -19,7 +19,7 @@
with_items: "{{ apache_ipaddr_whitelist_present }}"
notify: reload apache
tags:
- apache
- apache
- name: remove IP addresses from private IP whitelist
lineinfile:
@ -29,7 +29,7 @@
with_items: "{{ apache_ipaddr_whitelist_absent }}"
notify: reload apache
tags:
- apache
- apache
- name: include private IP whitelist for server-status
lineinfile:
@ -38,7 +38,7 @@
insertafter: 'SetHandler server-status'
state: present
tags:
- apache
- apache
- name: Copy private_htpasswd
copy:
@ -50,7 +50,7 @@
force: no
notify: reload apache
tags:
- apache
- apache
- name: add user:pwd to private htpasswd
lineinfile:
@ -60,7 +60,7 @@
with_items: "{{ apache_private_htpasswd_present }}"
notify: reload apache
tags:
- apache
- apache
- name: remove user:pwd from private htpasswd
lineinfile:
@ -70,4 +70,4 @@
with_items: "{{ apache_private_htpasswd_absent }}"
notify: reload apache
tags:
- apache
- apache

4
apache/tasks/log2mail.yml
View File

@ -4,6 +4,8 @@
apt:
name: log2mail
state: present
tags:
- apache
- name: Add log2mail config for Apache segfaults
template:
@ -13,3 +15,5 @@
group: adm
mode: "0644"
force: no
tags:
- apache

84
apache/tasks/main.yml
View File

@ -5,14 +5,14 @@
name: '{{ item }}'
state: present
with_items:
- apache2
- libapache2-mpm-itk
- libapache2-mod-evasive
- apachetop
- libwww-perl
- apache2
- libapache2-mpm-itk
- libapache2-mod-evasive
- apachetop
- libwww-perl
tags:
- apache
- packages
- apache
- packages
when: ansible_distribution_major_version | version_compare('9', '>=')
- name: packages are installed (jessie)
@ -20,13 +20,13 @@
name: '{{ item }}'
state: present
with_items:
- apache2-mpm-itk
- libapache2-mod-evasive
- apachetop
- libwww-perl
- apache2-mpm-itk
- libapache2-mod-evasive
- apachetop
- libwww-perl
tags:
- apache
- packages
- apache
- packages
when: ansible_distribution_release == "jessie"
- name: basic modules are enabled
@ -34,17 +34,21 @@
name: '{{ item }}'
state: present
with_items:
- rewrite
- expires
- headers
- cgi
- ssl
- include
- negotiation
- alias
- rewrite
- expires
- headers
- cgi
- ssl
- include
- negotiation
- alias
notify: reload apache
tags:
- apache
- apache
- include: server_status.yml
tags:
- apache
- name: Copy Apache defaults config file
copy:
@ -75,19 +79,23 @@
dest: /etc/apache2/mods-enabled/status.conf
state: absent
notify: reload apache
tags:
- apache
- name: Ensure Apache config files are enabled
command: "a2enconf {{ item }}"
register: command_result
changed_when: "'Enabling' in command_result.stderr"
with_items:
- z-evolinux-defaults.conf
- zzz-evolinux-custom.conf
- z-evolinux-defaults.conf
- zzz-evolinux-custom.conf
notify: reload apache
tags:
- apache
- apache
- include: auth.yml
tags:
- apache
- name: default vhost is installed
template:
@ -97,7 +105,7 @@
force: no
notify: reload apache
tags:
- apache
- apache
- name: default vhost is enabled
file:
@ -108,7 +116,7 @@
notify: reload apache
when: apache_evolinux_default_enabled
tags:
- apache
- apache
- name: is umask already present?
command: "grep -E '^umask ' /etc/apache2/envvars"
@ -117,7 +125,7 @@
register: envvar_grep_umask
check_mode: no
tags:
- apache
- apache
- name: Add a mark in envvars for umask
blockinfile:
@ -129,12 +137,22 @@
umask 007
when: envvar_grep_umask.rc != 0
tags:
- apache
- apache
- include_role:
name: remount-usr
tags:
- apache
- apache
- name: /usr/share/scripts exists
file:
dest: /usr/share/scripts
mode: "0700"
owner: root
group: root
state: directory
tags:
- apache
- name: "Install save_apache_status.sh"
copy:
@ -142,9 +160,15 @@
dest: /usr/share/scripts/save_apache_status.sh
mode: "0755"
force: no
tags:
- apache
- include: log2mail.yml
when: apache_log2mail_include
tags:
- apache
- include: munin.yml
when: apache_munin_include
tags:
- apache

37
apache/tasks/server_status.yml Normal file
View File

@ -0,0 +1,37 @@
---
- name: server status dirname exists
file:
dest: "{{ apache_serverstatus_suffix_file | dirname }}"
mode: "0700"
owner: root
group: root
state: directory
- name: set apache serverstatus suffix if provided
shell: "echo {{ apache_serverstatus_suffix }} > {{ apache_serverstatus_suffix_file }}"
when: apache_serverstatus_suffix != ""
- name: generate random string for server-status suffix
shell: "apg -a 1 -M N -n 1 > {{ apache_serverstatus_suffix_file }}"
args:
creates: "{{ apache_serverstatus_suffix_file }}"
- name: read apache server status suffix
command: "tail -n 1 {{ apache_serverstatus_suffix_file }}"
changed_when: False
check_mode: no
register: new_apache_serverstatus_suffix
- name: overwrite apache_serverstatus_suffix
set_fact:
apache_serverstatus_suffix: "{{ new_apache_serverstatus_suffix.stdout }}"
- debug:
var: apache_serverstatus_suffix
- name: replace server-status suffix in default site index
replace:
dest: /var/www/index.html
regexp: '__SERVERSTATUS_SUFFIX__'
replace: "{{ apache_serverstatus_suffix }}"

4
apache/templates/evolinux-default.conf.j2
View File

@ -53,7 +53,7 @@
</Location>
<IfModule mod_status.c>
<Location /server-status>
<Location /server-status-{{ apache_serverstatus_suffix | mandatory }}>
SetHandler server-status
include /etc/apache2/ipaddr_whitelist.conf
Require local
@ -112,7 +112,7 @@
LogLevel warn
<IfModule mod_status.c>
<Location /server-status>
<Location /server-status-{{ apache_serverstatus_suffix | mandatory }}>
SetHandler server-status
include /etc/apache2/ipaddr_whitelist.conf
Require local

2
bind/templates/logrotate_bind
View File

@ -1,7 +1,7 @@
/var/log/bind.log {
weekly
missingok
rotate 8
rotate 52
create 640 bind bind
sharedscripts
postrotate

3
evoacme/files/evoacme.cron
View File

@ -11,4 +11,5 @@ CRT_DIR="${CRT_DIR:-'/etc/letsencrypt'}"
export QUIET=1
find "${CRT_DIR}" -maxdepth 1 -mindepth 1 -type d ! -path "*accounts" ! -path "*hooks" -printf "%f\n" | xargs -n1 evoacme
find "${CRT_DIR}" -maxdepth 1 -mindepth 1 -type d ! -path "*accounts" ! -path "*hooks" -printf "%f\n" \
| xargs --max-args=1 --no-run-if-empty evoacme

427
evocheck/files/evocheck.sh
View File

@ -4,6 +4,9 @@
# Script to verify compliance of a Debian/OpenBSD server
# powered by Evolix
# Repository: https://gitlab.evolix.org/evolix/evocheck
# Commit: c99324488553a745a201022d44f8f78f224631eb
# Disable LANG*
export LANG=C
export LANGUAGE=C
@ -72,6 +75,31 @@ IS_MUNINRUNNING=1
IS_BACKUPUPTODATE=1
IS_GITPERMS=1
IS_NOTUPGRADED=1
IS_TUNE2FS_M5=1
IS_PRIVKEYWOLRDREADABLE=1
IS_EVOLINUXSUDOGROUP=1
IS_USERINADMGROUP=1
IS_APACHE2EVOLINUXCONF=1
IS_BACKPORTSCONF=1
IS_BIND9MUNIN=1
IS_BIND9LOGROTATE=1
IS_BROADCOMFIRMWARE=1
IS_HARDWARERAIDTOOL=1
IS_LOG2MAILSYSTEMDUNIT=1
IS_LISTUPGRADE=1
IS_MARIADBEVOLINUXCONF=1
IS_MARIADBSYSTEMDUNIT=1
IS_MYSQLMUNIN=1
IS_PHPEVOLINUXCONF=1
IS_SQUIDLOGROTATE=1
IS_SQUIDEVOLINUXCONF=1
IS_SQL_BACKUP=1
IS_POSTGRES_BACKUP=1
IS_LDAP_BACKUP=1
IS_REDIS_BACKUP=1
IS_ELASTIC_BACKUP=1
IS_MONGO_BACKUP=1
IS_MOUNT_FSTAB=1
#Proper to OpenBSD
IS_SOFTDEP=1
@ -100,7 +128,7 @@ fi
# Functions
is_pack_web(){
test -e /usr/share/scripts/web-add.sh
test -e /usr/share/scripts/web-add.sh || test -e /usr/share/scripts/evoadmin/web-add.sh
}
is_pack_samba(){
@ -114,7 +142,7 @@ is_installed(){
}
is_debianversion(){
[ $(lsb_release -c -s) = $1 ] && return 0;
[ $(lsb_release -c -s) = $1 ] && return 0
}
#-----------------------------------------------------------
@ -130,6 +158,7 @@ if [ -e /etc/debian_version ]; then
is_debianversion wheezy && ( ( [ "$IS_USRRO" = 1 ] || [ "$IS_TMPNOEXEC" = 1 ] ) && \
( test -e /etc/apt/apt.conf.d/80evolinux || echo 'IS_DPKGWARNING FAILED!' )
test -e /etc/apt/apt.conf && echo 'IS_DPKGWARNING FAILED!' )
is_debianversion stretch && (test -e /etc/apt/apt.conf.d/z-evolinux.conf || echo 'IS_DPKGWARNING FAILED!')
fi
if [ "$IS_UMASKSUDOERS" = 1 ]; then
@ -139,7 +168,7 @@ if [ -e /etc/debian_version ]; then
# Verifying check_mailq in Nagios NRPE config file. (Option "-M postfix" need to be set if the MTA is Postfix)
if [ "$IS_NRPEPOSTFIX" = 1 ]; then
is_debianversion squeeze && is_installed postfix && ( grep -q "^command.*check_mailq -M postfix" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPOSTFIX FAILED!' )
is_debianversion squeeze || ( is_installed postfix && ( grep -qr "^command.*check_mailq -M postfix" /etc/nagios/nrpe.* || echo 'IS_NRPEPOSTFIX FAILED!' ) )
is_debianversion squeeze || ( is_installed postfix && ( test -e /etc/nagios/nrpe.cfg && grep -qr "^command.*check_mailq -M postfix" /etc/nagios/nrpe.* || echo 'IS_NRPEPOSTFIX FAILED!' ) )
fi
# Check if mod-security config file is present
@ -157,23 +186,23 @@ if [ -e /etc/debian_version ]; then
if [ "$IS_VARTMPFS" = 1 ]; then
df /var/tmp | grep -q tmpfs || echo 'IS_VARTMPFS FAILED!'
fi
if [ "$IS_SERVEURBASE" = 1 ]; then
is_installed serveur-base || echo 'IS_SERVEURBASE FAILED!'
fi
if [ "$IS_LOGROTATECONF" = 1 ]; then
test -e /etc/logrotate.d/zsyslog || echo 'IS_LOGROTATECONF FAILED!'
fi
if [ "$IS_SYSLOGCONF" = 1 ]; then
grep -q "^# Syslog for Pack Evolix serveur" /etc/*syslog.conf || echo 'IS_SYSLOGCONF FAILED!'
fi
if [ "$IS_DEBIANSECURITY" = 1 ]; then
grep -q "^deb.*security" /etc/apt/sources.list || echo 'IS_DEBIANSECURITY FAILED!'
fi
if [ "$IS_APTITUDEONLY" = 1 ]; then
is_debianversion squeeze && test -e /usr/bin/apt-get && echo 'IS_APTITUDEONLY FAILED!'
is_debianversion wheezy && test -e /usr/bin/apt-get && echo 'IS_APTITUDEONLY FAILED!'
@ -181,10 +210,12 @@ if [ -e /etc/debian_version ]; then
if [ "$IS_APTITUDE" = 1 ]; then
is_debianversion jessie && test -e /usr/bin/aptitude && echo 'IS_APTITUDE FAILED!'
is_debianversion stretch && test -e /usr/bin/aptitude && echo 'IS_APTITUDE FAILED!'
fi
if [ "$IS_APTGETBAK" = 1 ]; then
is_debianversion jessie && test -e /usr/bin/apt-get.bak && echo 'IS_APTGETBAK FAILED!'
is_debianversion stretch && test -e /usr/bin/apt-get.bak && echo 'IS_APTGETBAK FAILED!'
fi
if [ "$IS_APTICRON" = 1 ]; then
@ -194,39 +225,52 @@ if [ -e /etc/debian_version ]; then
test "$status" = "fail" || test -e /usr/bin/apt-get.bak || status="fail"
( is_debianversion squeeze || is_debianversion wheezy ) && test "$status" = "fail" && echo 'IS_APTICRON FAILED!'
fi
if [ "$IS_USRRO" = 1 ]; then
grep /usr /etc/fstab | grep -q ro || echo 'IS_USRRO FAILED!'
fi
if [ "$IS_TMPNOEXEC" = 1 ]; then
mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!'
fi
if [ "$IS_LISTCHANGESCONF" = 1 ]; then
is_debianversion stretch || ( test -e /etc/apt/listchanges.conf && egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!' )
if [ "$IS_MOUNT_FSTAB" = 1 ]; then
# Test if lsblk available, if not skip this test...
if test -x "$(command -v lsblk)"; then
for mountPoint in $(lsblk -o MOUNTPOINT -l -n | grep '/'); do
grep -Eq "$mountPoint\W" /etc/fstab || echo 'IS_MOUNT_FSTAB FAILED!'
done
fi
fi
if [ "$IS_LISTCHANGESCONF" = 1 ]; then
if is_debianversion stretch; then
is_installed apt-listchanges && echo 'IS_LISTCHANGESCONF FAILED!'
else
test -e /etc/apt/listchanges.conf && egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!'
fi
fi
if [ "$IS_CUSTOMCRONTAB" = 1 ]; then
egrep "^(17 \*|25 6|47 6|52 6)" /etc/crontab | wc -l | grep -q ^4$ && echo 'IS_CUSTOMCRONTAB FAILED!'
fi
if [ "$IS_SSHALLOWUSERS" = 1 ]; then
egrep -qi "AllowUsers" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!'
fi
if [ "$IS_DISKPERF" = 1 ]; then
test -e /root/disk-perf.txt || echo 'IS_DISKPERF FAILED!'
fi
if [ "$IS_TMOUTPROFILE" = 1 ]; then
grep -q TMOUT= /etc/profile /etc/profile.d/evolinux.sh || echo 'IS_TMOUTPROFILE FAILED!'
fi
if [ "$IS_ALERT5BOOT" = 1 ]; then
grep -q ^date /etc/rc2.d/S*alert5 || echo 'IS_ALERT5BOOT FAILED!'
fi
if [ "$IS_ALERT5MINIFW" = 1 ]; then
grep -q ^/etc/init.d/minifirewall /etc/rc2.d/S*alert5 || echo 'IS_ALERT5MINIFW FAILED!'
fi
@ -234,17 +278,18 @@ if [ -e /etc/debian_version ]; then
if [ "$IS_ALERT5MINIFW" = 1 ] && [ "$IS_MINIFW" = 1 ]; then
/sbin/iptables -L -n | grep -q -E "^ACCEPT\s*all\s*--\s*31\.170\.8\.4\s*0\.0\.0\.0/0\s*$" || echo 'IS_MINIFW FAILED!'
fi
if [ "$IS_NRPEPERMS" = 1 ]; then
ls -ld /etc/nagios | grep -q drwxr-x--- || echo 'IS_NRPEPERMS FAILED!'
test -d /etc/nagios && ls -ld /etc/nagios | grep -q drwxr-x--- || echo 'IS_NRPEPERMS FAILED!'
fi
if [ "$IS_MINIFWPERMS" = 1 ]; then
is_debianversion squeeze && ( ls -l /etc/firewall.rc | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
is_debianversion wheezy && ( ls -l /etc/firewall.rc | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
is_debianversion jessie && ( ls -l /etc/default/minifirewall | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
is_debianversion stretch && ( ls -l /etc/default/minifirewall | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
fi
if [ "$IS_NRPEDISKS" = 1 ]; then
NRPEDISKS=$(grep command.check_disk /etc/nagios/nrpe.cfg | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1)
DFDISKS=$(df -Pl | egrep -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l)
@ -252,22 +297,23 @@ if [ -e /etc/debian_version ]; then
fi
if [ "$IS_NRPEPID" = 1 ]; then
! is_debianversion squeeze && (grep -q "^pid_file=/var/run/nagios/nrpe.pid" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPID FAILED!')
is_debianversion squeeze || (test -e /etc/nagios/nrpe.cfg && grep -q "^pid_file=/var/run/nagios/nrpe.pid" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPID FAILED!')
fi
if [ "$IS_GRSECPROCS" = 1 ]; then
uname -a | grep -q grsec && ( grep -q ^command.check_total_procs..sudo /etc/nagios/nrpe.cfg && grep -A1 "^\[processes\]" /etc/munin/plugin-conf.d/munin-node | grep -q "^user root" || echo 'IS_GRSECPROCS FAILED!' )
fi
if [ "$IS_APACHEMUNIN" = 1 ]; then
test -e /etc/apache2/apache2.conf && ( egrep -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' )
test -e /etc/apache2/apache2.conf && ( is_debianversion stretch || ( egrep -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' ) )
test -e /etc/apache2/apache2.conf && ( is_debianversion stretch && ( test -h /etc/apache2/mods-enabled/status.load && test -h /etc/munin/plugins/apache_accesses && test -h /etc/munin/plugins/apache_processes && test -h /etc/munin/plugins/apache_accesses || echo 'IS_APACHEMUNIN FAILED!' ) )
fi
# Verification mytop + Munin si MySQL
if [ "$IS_MYSQLUTILS" = 1 ]; then
is_installed mysql-server && ( grep -q mysqladmin /root/.my.cnf && is_installed mytop && grep -q debian-sys-maint /root/.mytop || echo 'IS_MYSQLUTILS FAILED!' )
is_installed mysql-server && ( grep -q mysqladmin /root/.my.cnf && test -x /usr/bin/mytop && grep -q debian-sys-maint /root/.mytop || echo 'IS_MYSQLUTILS FAILED!' )
fi
# Verification de la configuration du raid soft (mdadm)
if [ "$IS_RAIDSOFT" = 1 ]; then
test -e /proc/mdstat && grep -q md /proc/mdstat && \
@ -275,12 +321,12 @@ if [ -e /etc/debian_version ]; then
&& grep -q "^START_DAEMON=true" /etc/default/mdadm \
&& grep -qv "^MAILADDR ___MAIL___" /etc/mdadm/mdadm.conf || echo 'IS_RAIDSOFT FAILED!')
fi
# Verification du LogFormat de AWStats
if [ "$IS_AWSTATSLOGFORMAT" = 1 ]; then
is_installed apache2.2-common && ( grep -qE '^LogFormat=1' /etc/awstats/awstats.conf.local || echo 'IS_AWSTATSLOGFORMAT FAILED!' )
fi
# Verification de la présence de la config logrotate pour Munin
if [ "$IS_MUNINLOGROTATE" = 1 ]; then
( test -e /etc/logrotate.d/munin-node && test -e /etc/logrotate.d/munin ) || echo 'IS_MUNINLOGROTATE FAILED!'
@ -290,19 +336,21 @@ if [ -e /etc/debian_version ]; then
#if [ "$IS_METCHE" = 1 ]; then
# is_installed metche || echo 'IS_METCHE FAILED!'
#fi
# Verification de l'activation de Squid dans le cas d'un pack mail
if [ "$IS_SQUID" = 1 ]; then
squidconffile=/etc/squid*/squid.conf
is_debianversion squeeze && f=/etc/firewall.rc
is_debianversion wheezy && f=/etc/firewall.rc
is_debianversion jessie && f=/etc/default/minifirewall
is_debianversion stretch && f=/etc/default/minifirewall && squidconffile=/etc/squid/evolinux-custom.conf
is_pack_web && ( is_installed squid || is_installed squid3 \
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner proxy -j ACCEPT" $f \
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d `hostname -i` -j ACCEPT" $f \
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.(1|0/8) -j ACCEPT" $f \
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port.* `grep http_port /etc/squid*/squid.conf |cut -f 2 -d " "`" $f || echo 'IS_SQUID FAILED!' )
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port.* `grep http_port $squidconffile | cut -f 2 -d " "`" $f || echo 'IS_SQUID FAILED!' )
fi
# Verification de la conf et de l'activation de mod-deflate
if [ "$IS_MODDEFLATE" = 1 ]; then
f=/etc/apache2/mods-enabled/deflate.conf
@ -310,22 +358,27 @@ if [ -e /etc/debian_version ]; then
&& grep -q "AddOutputFilterByType DEFLATE text/css" $f \
&& grep -q "AddOutputFilterByType DEFLATE application/x-javascript application/javascript" $f || echo 'IS_MODDEFLATE FAILED!')
fi
# Verification de la conf log2mail
if [ "$IS_LOG2MAILRUNNING" = 1 ]; then
is_pack_web && (is_installed log2mail && pgrep log2mail >/dev/null || echo 'IS_LOG2MAILRUNNING')
fi
if [ "$IS_LOG2MAILAPACHE" = 1 ]; then
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/apache2/error.log" /etc/log2mail/config/default 2>/dev/null || echo 'IS_LOG2MAILAPACHE FAILED!' )
if is_debianversion stretch; then
conf=/etc/log2mail/config/apache
else
conf=/etc/log2mail/config/default
fi
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/apache2/error.log" $conf 2>/dev/null || echo 'IS_LOG2MAILAPACHE FAILED!' )
fi
if [ "$IS_LOG2MAILMYSQL" = 1 ]; then
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/syslog" /etc/log2mail/config/default 2>/dev/null || echo 'IS_LOG2MAILMYSQL FAILED!' )
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/syslog" /etc/log2mail/config/{default,mysql,mysql.conf} 2>/dev/null || echo 'IS_LOG2MAILMYSQL FAILED!' )
fi
if [ "$IS_LOG2MAILSQUID" = 1 ]; then
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/squid.*/access.log" \
/etc/log2mail/config/* 2>/dev/null || echo 'IS_LOG2MAILSQUID FAILED!' )
fi
# Verification si bind est chroote
if [ "$IS_BINDCHROOT" = 1 ]; then
if is_installed bind9 && $(netstat -utpln |grep "/named" |grep :53 |grep -qvE "(127.0.0.1|::1)"); then
@ -338,20 +391,23 @@ if [ -e /etc/debian_version ]; then
fi
fi
fi
# Verification de la présence du depot volatile
if [ "$IS_REPVOLATILE" = 1 ]; then
test `cat /etc/debian_version |cut -d "." -f 1` -eq 5 && (grep -qE "^deb http://volatile.debian.org/debian-volatile" /etc/apt/sources.list || echo 'IS_REPVOLATILE FAILED!')
test `cat /etc/debian_version |cut -d "." -f 1` -eq 6 && (grep -qE "^deb.*squeeze-updates" /etc/apt/sources.list || echo 'IS_REPVOLATILE FAILED!')
fi
# Verify if all if are in auto
if [ "$IS_AUTOIF" = 1 ]; then
for interface in `/sbin/ifconfig -s |tail -n +2 |egrep -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" |cut -d " " -f 1 |tr "\n" " "`; do
is_debianversion stretch || for interface in `/sbin/ifconfig -s |tail -n +2 |egrep -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" |cut -d " " -f 1 |tr "\n" " "`; do
grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break)
done
is_debianversion stretch && for interface in `/sbin/ip address show up | grep ^[0-9]*: |egrep -v "(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 2 |tr -d : |cut -d@ -f1 |tr "\n" " "`; do
grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break)
done
fi
# Network conf verification
if [ "$IS_INTERFACESGW" = 1 ]; then
number=$(grep -Ec "^[^#]*gateway [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" /etc/network/interfaces)
@ -364,13 +420,13 @@ if [ -e /etc/debian_version ]; then
if [ "$IS_EVOBACKUP" = 1 ]; then
ls /etc/cron* |grep -q "zz.backup$" || echo 'IS_EVOBACKUP FAILED!'
fi
# Verification de la presence du userlogrotate
if [ "$IS_USERLOGROTATE" = 1 ]; then
is_pack_web && (test -x /etc/cron.weekly/userlogrotate || echo 'IS_USERLOGROTATE FAILED!')
fi
# Verification de la syntaxe de la conf d'Apache
if [ "$IS_APACHECTL" = 1 ]; then
is_installed apache2.2-common && (/usr/sbin/apache2ctl configtest 2>&1 |grep -q "^Syntax OK$" || echo 'IS_APACHECTL FAILED!')
@ -386,7 +442,7 @@ if [ -e /etc/debian_version ]; then
if [ "$IS_APACHEIPINALLOW" = 1 ]; then
# Note: Replace "exit 1" by "print" in Perl code to debug it.
is_installed apache2.2-common && \
(grep -IrE "^[^#] *(Allow|Deny) from" /etc/apache2/ |grep -iv "from all" |perl -ne 'exit 1 unless (/from( [\da-f:.\/]+)+$/i)' || echo 'IS_APACHEIPINALLOW FAILED!')
(grep -IrE "^[^#] *(Allow|Deny) from" /etc/apache2/ |grep -iv "from all" |grep -iv "env=" |perl -ne 'exit 1 unless (/from( [\da-f:.\/]+)+$/i)' || echo 'IS_APACHEIPINALLOW FAILED!')
fi
# Check if default Apache configuration file for munin is absent (or empty or commented).
@ -398,19 +454,19 @@ if [ -e /etc/debian_version ]; then
fi
is_installed apache2.2-common && ([ -e $muninconf ] && grep -vEq "^( |\t)*#" $muninconf && echo 'IS_MUNINAPACHECONF FAILED!')
fi
# Verification de la priorité du package samba si les backports sont utilisés
if [ "$IS_SAMBAPINPRIORITY" = 1 ]; then
is_pack_samba && grep -qrE "^[^#].*backport" /etc/apt/sources.list{,.d} && ( priority=`grep -E -A2 "^Package:.*samba" /etc/apt/preferences |grep -A1 "^Pin: release a=lenny-backports" |grep "^Pin-Priority:" |cut -f2 -d" "` && test $priority -gt 500 || echo 'IS_SAMBAPINPRIORITY FAILED!' )
fi
# Verification si le système doit redémarrer suite màj kernel.
if [ "$IS_KERNELUPTODATE" = 1 ]; then
if is_installed linux-image* && [ $(date -d $(ls --full-time -lcrt /boot | tail -n1 | tr -s " " | cut -d " " -f 6) +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
echo 'IS_KERNELUPTODATE FAILED!'
fi
fi
# Check if the server is running for more than a year.
if [ "$IS_UPTIME" = 1 ]; then
if is_installed linux-image* && [ $(date -d "now - 1 year" +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
@ -437,7 +493,7 @@ if [ -e /etc/debian_version ]; then
# Check if /etc/.git/ has read/write permissions for root only.
if [ "$IS_GITPERMS" = 1 ]; then
[ "$(stat -c "%a" /etc/.git/)" = "700" ] || echo 'IS_GITPERMS FAILED!'
test -d /etc/.git && [ "$(stat -c "%a" /etc/.git/)" = "700" ] || echo 'IS_GITPERMS FAILED!'
fi
# Check if no package has been upgraded since $limit.
@ -452,6 +508,205 @@ if [ -e /etc/debian_version ]; then
[ $install_date -lt $limit ] && [ $last_upgrade -lt $limit ] && echo 'IS_NOTUPGRADED FAILED!'
fi
# Check if reserved blocks for root is at least 5% on every mounted partitions.
if [ "$IS_TUNE2FS_M5" = 1 ]; then
parts=$(grep -E "ext(3|4)" /proc/mounts | cut -d ' ' -f1 | tr -s '\n' ' ')
for part in $parts; do
blockCount=$(dumpe2fs -h "$part" 2>/dev/null | grep -e "Block count:" | grep -Eo "[0-9]+")
# If buggy partition, skip it.
if [ -z $blockCount ]; then
continue
fi
reservedBlockCount=$(dumpe2fs -h "$part" 2>/dev/null | grep -e "Reserved block count:" | grep -Eo "[0-9]+")
percentage=$(python -c "print(int(round(float(${reservedBlockCount})/${blockCount}*100)))")
if [ "$percentage" -lt 5 ]; then
echo 'IS_TUNE2FS_M5 FAILED!'
# Set debug to 1, to displays which partitions has less than 5%
debug=0
if [ "$debug" -eq 1 ]; then
echo "Partition $part has less than 5% reserved blocks!"
fi
fi
done
fi
if [ "$IS_EVOLINUXSUDOGROUP" = 1 ]; then
if is_debianversion stretch; then
(grep -q ^evolinux-sudo: /etc/group \
&& grep -q '^%evolinux-sudo ALL=(ALL:ALL) ALL' /etc/sudoers.d/evolinux) || echo 'IS_EVOLINUXSUDOGROUP FAILED!'
fi
fi
if [ "$IS_USERINADMGROUP" = 1 ]; then
if is_debianversion stretch; then
for user in $(grep ^evolinux-sudo: /etc/group |awk -F: '{print $4}' |tr ',' ' '); do
groups $user |grep -q adm || echo 'IS_USERINADMGROUP FAILED!'
done
fi
fi
if [ "$IS_APACHE2EVOLINUXCONF" = 1 ]; then
if (test -d /etc/apache2 && is_debianversion stretch); then
(test -L /etc/apache2/conf-enabled/z-evolinux-defaults.conf \
&& test -L /etc/apache2/conf-enabled/zzz-evolinux-custom.conf \
&& test -f /etc/apache2/ipaddr_whitelist.conf) || echo 'IS_APACHE2EVOLINUXCONF FAILED!'
fi
fi
if [ "$IS_BACKPORTSCONF" = 1 ]; then
if is_debianversion stretch; then
grep -q backports /etc/apt/sources.list && echo 'IS_BACKPORTSCONF FAILED!'
grep -q backports /etc/apt/sources.list.d/*.list && (grep -q backports /etc/apt/preferences.d/* || echo 'IS_BACKPORTSCONF FAILED!')
fi
fi
if [ "$IS_BIND9MUNIN" = 1 ]; then
if is_debianversion stretch && is_installed bind9; then
(test -L /etc/munin/plugins/bind9 && test -e /etc/munin/plugin-conf.d/bind9) || echo 'IS_BIND9MUNIN FAILED!'
fi
fi
if [ "$IS_BIND9LOGROTATE" = 1 ]; then
if is_debianversion stretch && is_installed bind9; then
test -e /etc/logrotate.d/bind9 || echo 'IS_BIND9LOGROTATE FAILED!'
fi
fi
if [ "$IS_BROADCOMFIRMWARE" = 1 ]; then
if lspci | grep -q 'NetXtreme II'; then
(is_installed firmware-bnx2 && grep -q "^deb http://mirror.evolix.org/debian.* non-free" /etc/apt/sources.list) || echo 'IS_BROADCOMFIRMWARE FAILED!'
fi
fi
if [ "$IS_HARDWARERAIDTOOL" = 1 ]; then
lspci |grep -q 'MegaRAID SAS' && (is_installed megacli && (is_installed megaclisas-status || is_installed megaraidsas-status) || echo 'IS_HARDWARERAIDTOOL FAILED!')
lspci |grep -q 'Hewlett-Packard Company Smart Array' && (is_installed cciss-vol-status || echo 'IS_HARDWARERAIDTOOL FAILED!')
fi
if [ "$IS_LOG2MAILSYSTEMDUNIT" = 1 ]; then
if is_debianversion stretch; then
(systemctl -q is-active log2mail.service && test -f /etc/systemd/system/log2mail.service && ! test -f /etc/init.d/log2mail) || echo 'IS_LOG2MAILSYSTEMDUNIT FAILED!'
fi
fi
if [ "$IS_LISTUPGRADE" = 1 ]; then
(test -f /etc/cron.d/listupgrade && test -x /usr/share/scripts/listupgrade.sh) || echo 'IS_LISTUPGRADE FAILED!'
fi
if [ "$IS_MARIADBEVOLINUXCONF" = 1 ]; then
if is_debianversion stretch && is_installed mariadb-server; then
(test -f /etc/mysql/mariadb.conf.d/z-evolinux-defaults.cnf \
&& test -f /etc/mysql/mariadb.conf.d/zzz-evolinux-custom.cnf) || echo 'IS_MARIADBEVOLINUXCONF FAILED!'
fi
fi
if [ "$IS_SQL_BACKUP" = 1 ]; then
if (is_installed "mysql-server" || is_installed "mariadb-server"); then
# You could change the default path in /etc/evocheck.cf
SQL_BACKUP_PATH=${SQL_BACKUP_PATH:-"/home/backup/mysql.bak.gz"}
test -f "$SQL_BACKUP_PATH" || echo 'IS_SQL_BACKUP FAILED!'
fi
fi
if [ "$IS_POSTGRES_BACKUP" = 1 ]; then
if is_installed "postgresql-9*"; then
# If you use something like barman, you should deactivate this check
# You could change the default path in /etc/evocheck.cf
POSTGRES_BACKUP_PATH=${POSTGRES_BACKUP_PATH:-"/home/backup/pg.dump.bak"}
test -f "$POSTGRES_BACKUP_PATH" || echo 'IS_POSTGRES_BACKUP FAILED!'
fi
fi
if [ "$IS_MONGO_BACKUP" = 1 ]; then
if is_installed "mongodb-org-server"; then
# You could change the default path in /etc/evocheck.cf
MONGO_BACKUP_PATH=${MONGO_BACKUP_PATH:-"/home/backup/mongodump"}
if [ -d "$MONGO_BACKUP_PATH" ]; then
for file in ${MONGO_BACKUP_PATH}/*/*.{json,bson}; do
# Skip indexes file.
if ! [[ "$file" =~ indexes ]]; then
if [ -f $file ] && [ $(stat -c "%Y" $file) -lt $(date +"%s" -d "now - 2 day") ]; then
echo 'IS_MONGO_BACKUP FAILED!'
fi
fi
done
else
echo 'IS_MONGO_BACKUP FAILED!'
fi
fi
fi
if [ "$IS_LDAP_BACKUP" = 1 ]; then
if is_installed slapd; then
# You could change the default path in /etc/evocheck.cf
LDAP_BACKUP_PATH=${LDAP_BACKUP_PATH:-"/home/backup/ldap.bak"}
test -f "$LDAP_BACKUP_PATH" || echo 'IS_LDAP_BACKUP FAILED!'
fi
fi
if [ "$IS_REDIS_BACKUP" = 1 ]; then
if is_installed redis-server; then
# You could change the default path in /etc/evocheck.cf
REDIS_BACKUP_PATH=${REDIS_BACKUP_PATH:-"/home/backup/dump.rdb"}
test -f "$REDIS_BACKUP_PATH" || echo 'IS_REDIS_BACKUP FAILED!'
fi
fi
if [ "$IS_ELASTIC_BACKUP" = 1 ]; then
if is_installed elasticsearch; then
# You could change the default path in /etc/evocheck.cf
ELASTIC_BACKUP_PATH=${ELASTIC_BACKUP_PATH:-"/home/backup/elasticsearch"}
test -d "$ELASTIC_BACKUP_PATH" || echo 'IS_ELASTIC_BACKUP FAILED!'
fi
fi
if [ "$IS_MARIADBSYSTEMDUNIT" = 1 ]; then
if is_debianversion stretch && is_installed mariadb-server; then
(systemctl -q is-active mariadb.service && test -f /etc/systemd/system/mariadb.service.d/evolinux.conf) || echo 'IS_MARIADBSYSTEMDUNIT FAILED!'
fi
fi
if [ "$IS_MYSQLMUNIN" = 1 ]; then
if is_debianversion stretch && is_installed mariadb-server; then
for file in mysql_bytes mysql_queries mysql_slowqueries mysql_threads mysql_connections mysql_files_tables mysql_innodb_bpool mysql_innodb_bpool_act mysql_innodb_io mysql_innodb_log mysql_innodb_rows mysql_innodb_semaphores mysql_myisam_indexes mysql_qcache mysql_qcache_mem mysql_sorts mysql_tmp_tables; do
test -L /etc/munin/plugins/$file || echo 'IS_MYSQLMUNIN FAILED!'
done
fi
fi
if [ "$IS_MYSQLNRPE" = 1 ]; then
if is_debianversion stretch && is_installed mariadb-server; then
(test -f ~nagios/.my.cnf \
&& [ $(stat -c %U ~nagios/.my.cnf) = "nagios" ] \
&& [ $(stat -c %a ~nagios/.my.cnf) = "600" ] \
&& grep -q -F "command[check_mysql]=/usr/lib/nagios/plugins/check_mysql -H localhost -f ~nagios/.my.cnf") || echo 'IS_MYSQLNRPE FAILED!'
fi
fi
if [ "$IS_PHPEVOLINUXCONF" = 1 ]; then
if is_debianversion stretch && is_installed php; then
(test -f /etc/php/7.0/cli/conf.d/z-evolinux-defaults.ini \
&& test -f /etc/php/7.0/cli/conf.d/zzz-evolinux-custom.ini) || echo 'IS_PHPEVOLINUXCONF FAILED!'
fi
fi
if [ "$IS_SQUIDLOGROTATE" = 1 ]; then
if is_debianversion stretch && is_installed squid; then
grep -q monthly /etc/logrotate.d/squid || echo 'IS_SQUIDLOGROTATE FAILED!'
fi
fi
if [ "$IS_SQUIDEVOLINUXCONF" = 1 ]; then
if is_debianversion stretch && is_installed squid; then
(grep -q "^CONFIG=/etc/squid/evolinux-defaults.conf$" /etc/default/squid \
&& test -f /etc/squid/evolinux-defaults.conf \
&& test -f /etc/squid/evolinux-whitelist-defaults.conf \
&& test -f /etc/squid/evolinux-whitelist-custom.conf \
&& test -f /etc/squid/evolinux-acl.conf \
&& test -f /etc/squid/evolinux-httpaccess.conf \
&& test -f /etc/squid/evolinux-custom.conf) || echo 'IS_SQUIDEVOLINUXCONF FAILED!'
fi
fi
fi
@ -460,19 +715,19 @@ if [ `uname -s` == "OpenBSD" ]; then
if [ "$IS_SOFTDEP" = 1 ]; then
grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
fi
if [ "$IS_WHEEL" = 1 ]; then
grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!'
fi
if [ "$IS_SUDOADMIN" = 1 ]; then
grep -qE "^User_Alias ADMIN=.*$" /etc/sudoers || echo 'IS_SUDOADMIN FAILED!'
fi
if [ "$IS_PKGMIRROR" = 1 ]; then
grep -qE "^export PKG_PATH=http://ftp\.fr\.openbsd\.org/pub/OpenBSD/[0-9.]+/packages/[a-z0-9]+/$" /root/.profile || echo 'IS_PKGMIRROR FAILED!'
fi
if [ "$IS_HISTORY" = 1 ]; then
f=/root/.profile
grep -q "^HISTFILE=\$HOME/.histfile" $f \
@ -481,68 +736,68 @@ if [ `uname -s` == "OpenBSD" ]; then
&& grep -q "^export HISTSIZE" $f \
|| echo 'IS_HISTORY FAILED!'
fi
if [ "$IS_VIM" = 1 ]; then
which vim 2>1 >> /dev/null || echo 'IS_VIM FAILED!'
fi
if [ "$IS_TTYC0SECURE" = 1 ]; then
grep -Eqv "^ttyC0.*secure$" /etc/ttys || echo 'IS_TTYC0SECURE FAILED!'
fi
if [ "$IS_CUSTOMSYSLOG" = 1 ]; then
grep -q Evolix /etc/newsyslog.conf || echo 'IS_CUSTOMSYSLOG FAILED!'
fi
if [ "$IS_NOINETD" = 1 ]; then
grep -q inetd=NO /etc/rc.conf.local 2>/dev/null || echo 'IS_NOINETD FAILED!'
fi
if [ "$IS_SUDOMAINT" = 1 ]; then
f=/etc/sudoers
grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $f \
&& grep -q "ADMIN ALL=NOPASSWD: MAINT" $f \
|| echo 'IS_SUDOMAINT FAILED!'
fi
if [ "$IS_POSTGRESQL" = 1 ]; then
pkg info | grep -q postgresql-client || echo 'IS_POSTGRESQL FAILED!'
fi
if [ "$IS_NRPE" = 1 ]; then
( pkg info | grep -qE "nagios-plugins-[0-9.]" \
&& pkg info | grep -q nagios-plugins-ntp \
&& pkg info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
fi
# if [ "$IS_NRPEDISKS" = 1 ]; then
# NRPEDISKS=$(grep command.check_disk /etc/nrpe.cfg 2>/dev/null | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1)
# DFDISKS=$(df -Pl | egrep -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l)
# [ "$NRPEDISKS" = "$DFDISKS" ] || echo 'IS_NRPEDISKS FAILED!'
# fi
# Verification du check_mailq dans nrpe.cfg (celui-ci doit avoir l'option "-M postfix" si le MTA est Postfix)
#
#
# if [ "$IS_NRPEPOSTFIX" = 1 ]; then
# pkg info | grep -q postfix && ( grep -q "^command.*check_mailq -M postfix" /etc/nrpe.cfg 2>/dev/null || echo 'IS_NRPEPOSTFIX FAILED!' )
# fi
if [ "$IS_NRPEDAEMON" = 1 ]; then
grep -q "echo -n ' nrpe'; /usr/local/sbin/nrpe -d" /etc/rc.local || echo 'IS_NREPEDAEMON FAILED!'
fi
if [ "$IS_ALERTBOOT" = 1 ]; then
grep -qE "^date \| mail -sboot/reboot .*evolix.fr$" /etc/rc.local || echo 'IS_ALERTBOOT FAILED!'
fi
if [ "$IS_RSYNC" = 1 ]; then
pkg info | grep -q rsync || echo 'IS_RSYNC FAILED!'
fi
if [ "$IS_CRONPATH" = 1 ]; then
grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || echo 'IS_CRONPATH FAILED!'
fi
#TODO
# - Check en profondeur de postfix
# - NRPEDISK et NRPEPOSTFIX
@ -561,24 +816,33 @@ if [ "$IS_USRSHARESCRIPTS" = 1 ]; then
fi
if [ "$IS_SSHPERMITROOTNO" = 1 ]; then
egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!'
is_debianversion stretch || ( egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
is_debianversion stretch && grep -q ^PermitRoot /etc/ssh/sshd_config && ( egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
fi
if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
if [ -f /etc/sudoers.d/evolinux ]; then
sudoers="/etc/sudoers.d/evolinux"
if ! is_debianversion stretch; then
if [ -f /etc/sudoers.d/evolinux ]; then
sudoers="/etc/sudoers.d/evolinux"
else
sudoers="/etc/sudoers"
fi
for i in $( (grep "^User_Alias *ADMIN" $sudoers | cut -d= -f2 | tr -d " "; grep ^sudo /etc/group |cut -d: -f 4) | tr "," "\n" |sort -u); do
grep -q "^trap.*sudo.*evomaintenance.sh" /home/$i/.*profile || echo 'IS_EVOMAINTENANCEUSERS FAILED!'
done
else
sudoers="/etc/sudoers"
for i in $(getent group evolinux-sudo | cut -d':' -f4 | tr ',' ' '); do
grep -q "^trap.*sudo.*evomaintenance.sh" /home/$i/.*profile || echo 'IS_EVOMAINTENANCEUSERS FAILED!'
done
fi
for i in $( (grep "^User_Alias *ADMIN" $sudoers | cut -d= -f2 | tr -d " "; grep ^sudo /etc/group |cut -d: -f 4) | tr "," "\n" |sort -u); do
grep -q "^trap.*sudo.*evomaintenance.sh" /home/$i/.*profile || echo 'IS_EVOMAINTENANCEUSERS FAILED!'
done
fi
# Verification de la configuration d'evomaintenance
if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
f=/etc/evomaintenance.cf
( grep "^export PGPASSWORD" $f |grep -qv "your-passwd" \
( test -e $f \
&& test $(stat -c "%a" $f) = "600" \
&& grep "^export PGPASSWORD" $f |grep -qv "your-passwd" \
&& grep "^PGDB" $f |grep -qv "your-db" \
&& grep "^PGTABLE" $f |grep -qv "your-table" \
&& grep "^PGHOST" $f |grep -qv "your-pg-host" \
@ -588,3 +852,12 @@ if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
&& grep "^URGENCYTEL" $f |grep -qv "06.00.00.00.00" \
&& grep "^REALM" $f |grep -qv "example.com" ) || echo 'IS_EVOMAINTENANCECONF FAILED!'
fi
if [ "$IS_PRIVKEYWOLRDREADABLE" = 1 ]; then
for f in /etc/ssl/private/*; do
perms=$(stat -c "%a" $f)
if [ ${perms: -1} != "0" ]; then
echo 'IS_PRIVKEYWOLRDREADABLE FAILED!'
fi
done
fi

8
evocheck/tasks/install_local.yml
View File

@ -2,6 +2,8 @@
- include_role:
name: remount-usr
when: evocheck_bin_dir | search ("/usr")
tags:
- evocheck
- name: Scripts dir is present
file:
@ -10,6 +12,8 @@
owner: root
group: root
mode: "0700"
tags:
- evocheck
- name: Copy evocheck.sh
copy:
@ -19,7 +23,7 @@
owner: root
force: yes
tags:
- evocheck
- evocheck
- name: Copy evocheck.cf
copy:
@ -27,4 +31,4 @@
dest: /etc/evocheck.cf
force: no
tags:
- evocheck
- evocheck

5
evolinux-base/defaults/main.yml
View File

@ -21,6 +21,10 @@ evolinux_apt_public_sources: True
evolinux_apt_upgrade: True
evolinux_apt_remove_aptitude: True
# etc-evolinux
evolinux_etcevolinux_include: True
# etc-git
evolinux_etcgit_include: True
@ -72,6 +76,7 @@ evolinux_packages_common: True
evolinux_packages_stretch: True
evolinux_packages_serveur_base: True
evolinux_packages_purge_openntpd: True
evolinux_packages_purge_locate: True
evolinux_packages_invalid_mta: True
evolinux_packages_delete_nfs: True
evolinux_packages_listchanges: True

9
evolinux-base/tasks/etc-evolinux.yml Normal file
View File

@ -0,0 +1,9 @@
---
- name: /etc/evolinux exists
file:
dest: /etc/evolinux
owner: root
group: root
mode: "0700"
state: directory

4
evolinux-base/tasks/main.yml
View File

@ -19,6 +19,10 @@
name: etc-git
when: evolinux_etcgit_include
- name: /etc/evolinux base
include: etc-evolinux.yml
when: evolinux_etcevolinux_include
- name: Hostname
include: hostname.yml
when: evolinux_hostname_include

10
evolinux-base/tasks/packages.yml
View File

@ -67,6 +67,16 @@
purge: yes
when: evolinux_packages_purge_openntpd
- name: Be sure locate/mlocate is absent/purged
apt:
name: "{{ item }}"
state: absent
purge: yes
with_items:
- locate
- mlocate
when: evolinux_packages_purge_locate
- name: Install/Update serveur-base meta-package
apt:
name: serveur-base

2
evolinux-base/templates/default_www/index.html.j2
View File

@ -58,7 +58,7 @@
<ul id="evolinks">
<li><a href="/munin/{{ ansible_domain }}/{{ ansible_fqdn }}/">Stats système</a></li>
<li><a href="/server-status">Server Status</a></li>
<li><a href="/server-status-__SERVERSTATUS_SUFFIX__">Server Status</a></li>
<!-- <li><a href="/phpmyadmin-__PHPMYADMIN_SUFFIX__/">Accès PhpMyAdmin</a></li> -->
<!-- <li><a href="/mysqlreport.html">Dernier rapport MySQL Tuner</a></li> -->
<!-- <li><a href="/cgi-bin/awstats.pl">Stats web</a></li> -->

12
evolinux-users/tasks/sudo_stretch.yml
View File

@ -1,6 +1,6 @@
---
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
- name: "Verify 'evolinux' sudoers file presence (Debian 9 or later)"
template:
src: sudoers_stretch.j2
dest: /etc/sudoers.d/evolinux
@ -8,13 +8,19 @@
validate: '/usr/sbin/visudo -cf %s'
register: copy_sudoers_evolinux
- name: "Create evolinux-sudo group (Debian 9 or later)"
- name: "Create '{{ evolinux_sudo_group }}' group (Debian 9 or later)"
group:
name: "{{ evolinux_sudo_group }}"
system: yes
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
- name: "Add user to '{{ evolinux_sudo_group }}' group (Debian 9 or later)"
user:
name: '{{ user.name }}'
groups: "{{ evolinux_sudo_group }}"
append: yes
- name: "Add user to 'adm' group (Debian 9 or later)"
user:
name: '{{ user.name }}'
groups: "adm"
append: yes

19
evomaintenance/tasks/main.yml
View File

@ -3,30 +3,45 @@
include_role:
name: apt
tasks_from: evolix_public.yml
tags:
- evomaintenance
- name: evomaintenance is installed
apt:
name: evomaintenance
allow_unauthenticated: yes
tags:
- evomaintenance
- name: configuration is applied
template:
src: evomaintenance.j2
dest: /etc/evomaintenance.cf
owner: root
group: root
mode: "0600"
tags:
- evomaintenance
# - name: list users with a shell
# shell: "cat /etc/passwd | grep -vE \"^root:\" | grep -E \":/[^:]+sh$\" | cut -d: -f6"
# changed_when: False
# check_mode: no
# register: home_of_shell_users
# tags:
# - evomaintenance
#
# - include: trap.yml home={{ item }}
# with_items: "{{ home_of_shell_users.stdout_lines }}"
# tags:
# - evomaintenance
- name: Is minifirewall installed?
stat:
path: /etc/default/minifirewall
register: minifirewall_default_file
tags:
- evomaintenance
- name: minifirewall section for evomaintenance
lineinfile:
@ -35,6 +50,8 @@
insertafter: "^# EvoMaintenance"
with_items: "{{ evomaintenance_hosts }}"
when: minifirewall_default_file.stat.exists
tags:
- evomaintenance
- name: remove minifirewall example rule for the proxy
lineinfile:
@ -42,3 +59,5 @@
regexp: '^#.*(--sport 5432).*(-s X\.X\.X\.X)'
state: absent
when: minifirewall_default_file.stat.exists
tags:
- evomaintenance

8
evomaintenance/tasks/trap.yml
View File

@ -3,6 +3,8 @@
path: "{{ home }}/.bash_profile"
check_mode: no
register: bash_profile
tags:
- evomaintenance
- name: install shell trap in {{ home }}/.bash_profile
lineinfile:
@ -11,6 +13,8 @@
insertafter: EOF
create: no
when: bash_profile.stat.exists
tags:
- evomaintenance
- name: is {{ home }}/.profile present?
stat:
@ -18,6 +22,8 @@
check_mode: no
register: profile
when: not bash_profile.stat.exists
tags:
- evomaintenance
- name: install shell trap in {{ home }}/.profile
lineinfile:
@ -26,3 +32,5 @@
insertafter: EOF
create: yes
when: not bash_profile.stat.exists
tags:
- evomaintenance

18
evomaintenance/templates/evomaintenance.j2
View File

@ -1,13 +1,13 @@
HOSTNAME={{ evomaintenance_hostname }}
EVOMAINTMAIL={{ evomaintenance_alert_email or general_alert_email | mandatory }}
HOSTNAME="{{ evomaintenance_hostname }}"
EVOMAINTMAIL="{{ evomaintenance_alert_email or general_alert_email | mandatory }}"
export PGPASSWORD={{ evomaintenance_pg_passwd }}
export PGPASSWORD="{{ evomaintenance_pg_passwd }}"
PGDB={{ evomaintenance_pg_db }}
PGTABLE={{ evomaintenance_pg_table }}
PGHOST={{ evomaintenance_pg_host }}
FROM={{ evomaintenance_from }}
PGDB="{{ evomaintenance_pg_db }}"
PGTABLE="{{ evomaintenance_pg_table }}"
PGHOST="{{ evomaintenance_pg_host }}"
FROM="{{ evomaintenance_from }}"
FULLFROM="{{ evomaintenance_full_from }}"
URGENCYFROM={{ evomaintenance_urgency_from }}
URGENCYFROM="{{ evomaintenance_urgency_from }}"
URGENCYTEL="{{ evomaintenance_urgency_tel }}"
REALM={{ evomaintenance_realm }}
REALM="{{ evomaintenance_realm }}"

4
nginx/defaults/main.yml
View File

@ -16,4 +16,6 @@ nginx_default_redirect_url: "http://evolix.fr"
nginx_evolinux_default_enabled: True
# nginx_phpmyadmin_suffix: ""
# nginx_serverstatus_suffix: ""
nginx_serverstatus_suffix: ""
nginx_serverstatus_suffix_file: "/etc/evolinux/nginx_serverstatus_suffix"

4
nginx/tasks/logrotate.yml
View File

@ -1,6 +1,10 @@
---
- name: logrotate configuration
copy:
src: logrotate_nginx
dest: /etc/logrotate.d/nginx
force: no
tags:
- nginx
- logrotate

40
nginx/tasks/main_regular.yml
View File

@ -16,7 +16,7 @@
line: ' worker_connections 1024;'
insertafter: 'events \{'
tags:
- nginx
- nginx
- name: use epoll
lineinfile:
@ -25,7 +25,7 @@
line: ' use epoll;'
insertafter: 'events \{'
tags:
- nginx
- nginx
- name: Install Nginx http configuration
copy:
@ -35,7 +35,7 @@
# force: yes
notify: reload nginx
tags:
- nginx
- nginx
# TODO: verify that those permissions are correct :
# not too strict for ipaddr_whitelist
@ -52,7 +52,7 @@
force: no
notify: reload nginx
tags:
- nginx
- nginx
- name: add IP addresses to private IP whitelist
lineinfile:
@ -62,7 +62,7 @@
with_items: "{{ nginx_ipaddr_whitelist_present }}"
notify: reload nginx
tags:
- nginx
- nginx
- name: remove IP addresses from private IP whitelist
lineinfile:
@ -72,7 +72,7 @@
with_items: "{{ nginx_ipaddr_whitelist_absent }}"
notify: reload nginx
tags:
- nginx
- nginx
- name: Copy private_htpasswd
copy:
@ -85,7 +85,7 @@
force: no
notify: reload nginx
tags:
- nginx
- nginx
- name: add user:pwd to private htpasswd
lineinfile:
@ -95,7 +95,7 @@
with_items: "{{ nginx_private_htpasswd_present }}"
notify: reload nginx
tags:
- nginx
- nginx
- name: remove user:pwd from private htpasswd
lineinfile:
@ -105,7 +105,11 @@
with_items: "{{ nginx_private_htpasswd_absent }}"
notify: reload nginx
tags:
- nginx
- nginx
- include: server_status.yml
tags:
- nginx
- name: nginx vhost is installed
template:
@ -115,7 +119,7 @@
force: no
notify: reload nginx
tags:
- nginx
- nginx
- name: default vhost is enabled
file:
@ -126,7 +130,7 @@
notify: reload nginx
when: nginx_evolinux_default_enabled
tags:
- nginx
- nginx
# - block:
# - name: generate random string for phpmyadmin suffix
@ -168,7 +172,7 @@
enabled: yes
state: started
tags:
- nginx
- nginx
- name: Check if Munin is installed
stat:
@ -176,19 +180,19 @@
check_mode: no
register: stat_munin_node
tags:
- nginx
- munin
- nginx
- munin
- include: munin_vhost.yml
when: stat_munin_node.stat.exists
tags:
- nginx
- munin
- nginx
- munin
- include: munin_graphs.yml
when: stat_munin_node.stat.exists
tags:
- nginx
- munin
- nginx
- munin
- include: logrotate.yml

4
nginx/tasks/packages_jessie.yml
View File

@ -7,5 +7,5 @@
state: present
notify: restart nginx
tags:
- nginx
- packages
- nginx
- packages

12
nginx/tasks/packages_jessie_backports.yml
View File

@ -4,8 +4,8 @@
name: apt
tasks_from: backports.yml
tags:
- nginx
- packages
- nginx
- packages
- name: Prefer Nginx packages from jessie-backports
copy:
@ -15,13 +15,13 @@
mode: "0640"
register: nginx_apt_preferences
tags:
- nginx
- packages
- nginx
- packages
- name: update apt
apt:
update_cache: yes
when: nginx_apt_preferences | changed
tags:
- nginx
- packages
- nginx
- packages

37
nginx/tasks/server_status.yml Normal file
View File

@ -0,0 +1,37 @@
---
- name: server status dirname exists
file:
dest: "{{ nginx_serverstatus_suffix | dirname }}"
mode: "0700"
owner: root
group: root
state: directory
- name: set nginx serverstatus suffix if provided
shell: "echo {{ nginx_serverstatus_suffix }} > {{ nginx_serverstatus_suffix_file }}"
when: nginx_serverstatus_suffix != ""
- name: generate random string for server-status suffix
shell: "apg -a 1 -M N -n 1 > {{ nginx_serverstatus_suffix_file }}"
args:
creates: "{{ nginx_serverstatus_suffix_file }}"
- name: read nginx server status suffix
command: "tail -n 1 {{ nginx_serverstatus_suffix_file }}"
changed_when: False
check_mode: no
register: new_nginx_serverstatus_suffix
- name: overwrite nginx_serverstatus_suffix
set_fact:
nginx_serverstatus_suffix: "{{ new_nginx_serverstatus_suffix.stdout }}"
- debug:
var: nginx_serverstatus_suffix
- name: replace server-status suffix in default site index
replace:
dest: /var/www/index.html
regexp: '__SERVERSTATUS_SUFFIX__'
replace: "{{ nginx_serverstatus_suffix }}"

2
nginx/templates/evolinux-default.conf.j2
View File

@ -48,7 +48,7 @@ server {
listen 80;
server_name munin;
location /nginx_status {
location /nginx_status-{{ nginx_serverstatus_suffix | mandatory }} {
stub_status on;
access_log off;
}

2
rbenv/defaults/main.yml
View File

@ -1,6 +1,6 @@
---
rbenv_version: v1.1.1
rbenv_ruby_version: 2.4.2
rbenv_ruby_version: 2.5.0
rbenv_root: "~/.rbenv"
rbenv_repo: "https://github.com/rbenv/rbenv.git"
rbenv_plugins:

3
redis/defaults/main.yml
View File

@ -31,5 +31,8 @@ redis_maxmemory_samples: 5
redis_appendonly: "no"
redis_appendfsync: "everysec"
# Supported only in Redis 3.2+
redis_protected_mode: "yes"
# Add extra include files for local configuration/overrides.
redis_includes: []

34
redis/tasks/main.yml
View File

@ -4,11 +4,21 @@
name: "{{ item }}"
state: present
with_items:
- redis-server
- redis-tools
- redis-server
- redis-tools
tags:
- redis
- packages
- redis
- packages
- name: Get Redis version
shell: "redis-server -v | grep -Eo '(v=\\S+)' | cut -d'=' -f 2 | grep -E '^([0-9]|\\.)+$'"
changed_when: false
check_mode: no
register: _redis_installed_version
- set_fact:
redis_installed_version: "{{ _redis_installed_version.stdout }}"
check_mode: no
- name: Redis is configured.
template:
@ -17,7 +27,7 @@
mode: "0644"
notify: restart redis
tags:
- redis
- redis
- name: Redis is running and enabled on boot.
service:
@ -25,21 +35,33 @@
enabled: yes
state: started
tags:
- redis
- redis
- name: Is Munin installed
stat:
path: /etc/munin/plugins
register: _munin_installed
tags:
- redis
- munin
- include: munin.yml
when: _munin_installed.stat.exists and _munin_installed.stat.isdir
tags:
- redis
- munin
- name: is NRPE present ?
stat:
path: /etc/nagios/nrpe.d/evolix.cfg
check_mode: no
register: nrpe_evolix_config
tags:
- redis
- nrpe
- include: nrpe_stretch.yml
when: ansible_distribution_release == "stretch" and nrpe_evolix_config.stat.exists == true
tags:
- redis
- nrpe

16
redis/tasks/munin.yml
View File

@ -4,26 +4,28 @@
name: libswitch-perl
state: present
tags:
- redis
- redis
- include_role:
name: remount-usr
tags:
- redis
- redis
- name: Create plugin directory
file:
name: /usr/local/share/munin/
state: directory
mode: "0755"
tags: redis
tags:
- redis
- name: Create plugin directory
file:
name: /usr/local/share/munin/plugins/
state: directory
mode: "0755"
tags: redis
tags:
- redis
- name: Copy redis munin plugin
copy:
@ -31,7 +33,8 @@
dest: /usr/local/share/munin/plugins/redis_
mode: "0755"
notify: restart munin-node
tags: redis
tags:
- redis
- name: Enable redis munin plugin
file:
@ -46,7 +49,8 @@
- used_keys
- used_memory
notify: restart munin-node
tags: redis
tags:
- redis
- name: Count redis condif blocks in munin-node configuration
command: grep -c "\[redis_" /etc/munin/plugin-conf.d/munin-node

4
redis/templates/redis.conf.j2
View File

@ -32,6 +32,10 @@ rdbcompression {{ redis_rdbcompression }}
dbfilename {{ redis_dbfilename }}
dir {{ redis_dbdir }}
{% if redis_installed_version | version_compare('3.2', '>=') %}
protected-mode {{ redis_protected_mode }}
{% endif %}
# maxclients 128
{% if redis_maxmemory %}

2
redmine/defaults/main.yml
View File

@ -6,3 +6,5 @@ puma_max_thread: 4
redmine_db_name: "{{ redmine_user }}"
redmine_db_host: "localhost"
redmine_db_username: "{{ redmine_user }}"
redmine_plugins: []
redmine_themes: []

1
redmine/files/Gemfile.local
View File

@ -1 +1,2 @@
gem "puma"
gem "xpath", "< 3.0.0"

21
redmine/tasks/main.yml
View File

@ -211,6 +211,18 @@
tags:
- redmine
- name: Install Redmine plugins
include: plugins.yml
with_items: "{{ redmine_plugins }}"
tags:
- redmine
- name: Install Redmine themes
include: themes.yml
with_items: "{{ redmine_themes }}"
tags:
- redmine
- name: Update local gems with bundle
bundler:
state: present
@ -218,7 +230,7 @@
gem_path: "/home/{{ redmine_user }}/.gems"
user_install: yes
become_user: "{{ redmine_user }}"
when: redmine_git_task.changed or redmine_local_gemfile_task.changed
when: redmine_git_task.changed or redmine_local_gemfile_task.changed or redmine_plugin_install.changed
- name: Migrate database with rake
shell: bundle exec rake -qf ~/www/Rakefile db:migrate
@ -235,6 +247,13 @@
become_method: sudo
become_flags: '-iu {{ redmine_user }}'
- name: Migrate plugins
shell: bundle exec rake -qf ~/www/Rakefile redmine:plugins:migrate
become_user: "{{ redmine_user }}"
become_method: sudo
become_flags: '-iu {{ redmine_user }}'
when: redmine_plugin_install.changed
- name: Generate secret token
shell: bundle exec rake -qf ~/www/Rakefile generate_secret_token
args:

28
redmine/tasks/plugins.yml Normal file
View File

@ -0,0 +1,28 @@
---
- name: Copy/Update plugin from archive
unarchive:
src: "{{ item.zip }}"
dest: "/home/{{ redmine_user }}/www/plugins/"
remote_src: yes
owner: "{{ redmine_user }}"
group: "{{ redmine_user }}"
mode: "0750"
register: redmine_plugin_install
when: item.zip is defined
- name: Copy/Update plugin from git repository
git:
repo: "{{ item.git }}"
dest: "/home/{{ redmine_user }}/www/plugins/{{ item.git | basename | splitext | first }}"
version: "{{ item.tree | default('master') }}"
register: redmine_plugin_install
when: item.git is defined
- name: Fix rights on plugin dir
file:
path: "/home/{{ redmine_user }}/www/plugins/{{ item.git | basename | splitext | first }}"
owner: "{{ redmine_user }}"
group: "{{ redmine_user }}"
mode: "u=rwX,g=rX,o="
recurse: True
when: item.git is defined

26
redmine/tasks/themes.yml Normal file
View File

@ -0,0 +1,26 @@
---
- name: Copy/Update theme from archive
unarchive:
src: "{{ item.zip }}"
dest: "/home/{{ redmine_user }}/www/public/themes/"
remote_src: yes
owner: "{{ redmine_user }}"
group: "{{ redmine_user }}"
mode: "0750"
when: item.zip is defined
- name: Copy/Update theme from git repository
git:
repo: "{{ item.git }}"
dest: "/home/{{ redmine_user }}/www/public/themes/{{ item.git | basename | splitext | first }}"
version: "{{ item.tree | default('master') }}"
when: item.git is defined
- name: Fix rights on theme dir
file:
path: "/home/{{ redmine_user }}/www/public/themes/{{ item.git | basename | splitext | first }}"
owner: "{{ redmine_user }}"
group: "{{ redmine_user }}"
mode: "0750"
recurse: True
when: item.git is defined

6
squid/tasks/logrotate.yml
View File

@ -1,6 +0,0 @@
---
- name: logrotate configuration
template:
src: logrotate.j2
dest: /etc/logrotate.d/{{ squid_daemon_name }}
force: no

29
squid/tasks/logrotate_jessie.yml Normal file
View File

@ -0,0 +1,29 @@
---
# md5sum for squid logrotate file :
#
# --check reads stdin for a list of files and md5 sums
# the list contains the checksum for the file provided by Jessie
#
# We don't use --status so we can debug if needed
#
# With that command we can check if the logrotate file for squid
# is the one provided by the package.
- name: check if logrotate file is default
shell: 'printf "43994674706b672ae5018f592beccf2e /etc/logrotate.d/{{ squid_daemon_name }}" | md5sum --check'
changed_when: False
failed_when: False
check_mode: no
register: squid_logrotate_md5
tags:
- squid
- name: logrotate configuration
template:
src: logrotate_jessie.j2
dest: /etc/logrotate.d/{{ squid_daemon_name }}
force: yes
when: squid_logrotate_md5.rc == 0
tags:
- squid

29
squid/tasks/logrotate_stretch.yml Normal file
View File

@ -0,0 +1,29 @@
---
# md5sum for squid logrotate file :
#
# --check reads stdin for a list of files and md5 sums
# the list contains the checksum for the file provided by Stretch
#
# We don't use --status so we can debug if needed
#
# With that command we can check if the logrotate file for squid
# is the one provided by the package.
- name: check if logrotate file is default
shell: 'printf "c210feea019412adac8a5d5dcba427af /etc/logrotate.d/{{ squid_daemon_name }}" | md5sum --check'
changed_when: False
failed_when: False
check_mode: no
register: squid_logrotate_md5
tags:
- squid
- name: logrotate configuration
template:
src: logrotate_stretch.j2
dest: /etc/logrotate.d/{{ squid_daemon_name }}
force: yes
when: squid_logrotate_md5.rc == 0
tags:
- squid

6
squid/tasks/main.yml
View File

@ -134,7 +134,11 @@
notify: "reload squid"
when: ansible_distribution_major_version | version_compare('9', '>=')
- include: logrotate.yml
- include: logrotate_jessie.yml
when: ansible_distribution_release == "jessie"
- include: logrotate_stretch.yml
when: ansible_distribution_major_version | version_compare('9', '>=')
- include: minifirewall.yml

11
squid/templates/logrotate.j2
View File

@ -1,11 +0,0 @@
/var/log/{{ squid_daemon_name }}/*.log {
monthly
compress
rotate 12
missingok
create 640 proxy adm
sharedscripts
postrotate
test ! -e /var/run/{{ squid_daemon_name }}.pid || /usr/sbin/{{ squid_daemon_name }} -k rotate
endscript
}

14
squid/templates/logrotate_jessie.j2 Normal file
View File

@ -0,0 +1,14 @@
#
# Logrotate fragment for squid3.
#
/var/log/squid3/*.log {
monthly
compress
rotate 12
missingok
create 640 proxy adm
sharedscripts
postrotate
test ! -e /var/run/squid3.pid || test ! -x /usr/sbin/squid3 || /usr/sbin/squid3 -k rotate
endscript
}

18
squid/templates/logrotate_stretch.j2 Normal file
View File

@ -0,0 +1,18 @@
#
# Logrotate fragment for squid.
#
/var/log/squid/*.log {
monthly
compress
delaycompress
rotate 12
missingok
create 640 proxy adm
sharedscripts
prerotate
test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports monthly
endscript
postrotate
test ! -e /var/run/squid.pid || test ! -x /usr/sbin/squid || /usr/sbin/squid -k rotate
endscript
}

10
unbound/tasks/main.yml
View File

@ -7,6 +7,16 @@
tags:
- unbound
- name: Retrieve list of root DNS servers
get_url:
url: https://www.internic.net/domain/named.cache
dest: /etc/unbound/root.hints
force: yes
mode: "0644"
notify: reload unbound
tags:
- unbound
- name: Copy Unbound config
template:
src: unbound.conf.j2

2
unbound/templates/unbound.conf.j2
View File

@ -13,7 +13,7 @@ server:
hide-identity: yes
hide-version: yes
# root-hints: "/var/unbound/etc/named.cache"
root-hints: "/etc/unbound/root.hints"
# Uncomment to enable DNSSEC validation.
#auto-trust-anchor-file: "/etc/unbound/root.key"
# Serve zones authoritatively from Unbound to resolver clients.