Merge branch 'unstable' into stable
This commit is contained in:
commit
72695db53b
34
CHANGELOG.md
Normal file
34
CHANGELOG.md
Normal file
|
@ -0,0 +1,34 @@
|
|||
# Changelog
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
|
||||
and this project tries to adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
## [9.1.5]
|
||||
|
||||
### Added
|
||||
* There is changelog!
|
||||
* Redis: configuration variable for protected mode (v3.2+)
|
||||
* evolinux-users: users are in "adm" group for Debian 9 or later
|
||||
* evolinx-base: purge locate/mlocate packages
|
||||
* evolinx-base: create /etc/evolinux if missing
|
||||
* many Ansible tags for easier fine grained execution of playbooks
|
||||
* apache/nginx: server status suffix management
|
||||
* unbound: retrieve list of root DNS servers
|
||||
* redmine: ability to install thems and plugins
|
||||
|
||||
### Changed
|
||||
* Rbenv: Ruby 2.5 becomes the default version
|
||||
* evocheck: update upstream version embedded in role (c993244)
|
||||
* bind: keep 52 weeks of logs
|
||||
|
||||
### Fixed
|
||||
* squid: different logrotate file for Jessie or Stretch+
|
||||
* evoacme: don't invoke evoacme if no vhost is found
|
||||
* evomaintenance: explicit quotes in config file
|
||||
* redmine: force xpath gem < 3.0.0
|
||||
|
||||
### Security
|
||||
* evomaintenance: fix permissions for config file
|
|
@ -12,6 +12,7 @@ apache_evolinux_default_ssl_cert: /etc/ssl/certs/ssl-cert-snakeoil.pem
|
|||
apache_evolinux_default_ssl_key: /etc/ssl/private/ssl-cert-snakeoil.key
|
||||
|
||||
apache_serverstatus_suffix: ""
|
||||
apache_serverstatus_suffix_file: "/etc/evolinux/apache_serverstatus_suffix"
|
||||
|
||||
apache_log2mail_include: True
|
||||
apache_munin_include: True
|
||||
|
|
|
@ -4,6 +4,8 @@
|
|||
apt:
|
||||
name: log2mail
|
||||
state: present
|
||||
tags:
|
||||
- apache
|
||||
|
||||
- name: Add log2mail config for Apache segfaults
|
||||
template:
|
||||
|
@ -13,3 +15,5 @@
|
|||
group: adm
|
||||
mode: "0644"
|
||||
force: no
|
||||
tags:
|
||||
- apache
|
||||
|
|
|
@ -46,6 +46,10 @@
|
|||
tags:
|
||||
- apache
|
||||
|
||||
- include: server_status.yml
|
||||
tags:
|
||||
- apache
|
||||
|
||||
- name: Copy Apache defaults config file
|
||||
copy:
|
||||
src: evolinux-defaults.conf
|
||||
|
@ -75,6 +79,8 @@
|
|||
dest: /etc/apache2/mods-enabled/status.conf
|
||||
state: absent
|
||||
notify: reload apache
|
||||
tags:
|
||||
- apache
|
||||
|
||||
- name: Ensure Apache config files are enabled
|
||||
command: "a2enconf {{ item }}"
|
||||
|
@ -88,6 +94,8 @@
|
|||
- apache
|
||||
|
||||
- include: auth.yml
|
||||
tags:
|
||||
- apache
|
||||
|
||||
- name: default vhost is installed
|
||||
template:
|
||||
|
@ -136,15 +144,31 @@
|
|||
tags:
|
||||
- apache
|
||||
|
||||
- name: /usr/share/scripts exists
|
||||
file:
|
||||
dest: /usr/share/scripts
|
||||
mode: "0700"
|
||||
owner: root
|
||||
group: root
|
||||
state: directory
|
||||
tags:
|
||||
- apache
|
||||
|
||||
- name: "Install save_apache_status.sh"
|
||||
copy:
|
||||
src: save_apache_status.sh
|
||||
dest: /usr/share/scripts/save_apache_status.sh
|
||||
mode: "0755"
|
||||
force: no
|
||||
tags:
|
||||
- apache
|
||||
|
||||
- include: log2mail.yml
|
||||
when: apache_log2mail_include
|
||||
tags:
|
||||
- apache
|
||||
|
||||
- include: munin.yml
|
||||
when: apache_munin_include
|
||||
tags:
|
||||
- apache
|
||||
|
|
37
apache/tasks/server_status.yml
Normal file
37
apache/tasks/server_status.yml
Normal file
|
@ -0,0 +1,37 @@
|
|||
---
|
||||
|
||||
- name: server status dirname exists
|
||||
file:
|
||||
dest: "{{ apache_serverstatus_suffix_file | dirname }}"
|
||||
mode: "0700"
|
||||
owner: root
|
||||
group: root
|
||||
state: directory
|
||||
|
||||
- name: set apache serverstatus suffix if provided
|
||||
shell: "echo {{ apache_serverstatus_suffix }} > {{ apache_serverstatus_suffix_file }}"
|
||||
when: apache_serverstatus_suffix != ""
|
||||
|
||||
- name: generate random string for server-status suffix
|
||||
shell: "apg -a 1 -M N -n 1 > {{ apache_serverstatus_suffix_file }}"
|
||||
args:
|
||||
creates: "{{ apache_serverstatus_suffix_file }}"
|
||||
|
||||
- name: read apache server status suffix
|
||||
command: "tail -n 1 {{ apache_serverstatus_suffix_file }}"
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
register: new_apache_serverstatus_suffix
|
||||
|
||||
- name: overwrite apache_serverstatus_suffix
|
||||
set_fact:
|
||||
apache_serverstatus_suffix: "{{ new_apache_serverstatus_suffix.stdout }}"
|
||||
|
||||
- debug:
|
||||
var: apache_serverstatus_suffix
|
||||
|
||||
- name: replace server-status suffix in default site index
|
||||
replace:
|
||||
dest: /var/www/index.html
|
||||
regexp: '__SERVERSTATUS_SUFFIX__'
|
||||
replace: "{{ apache_serverstatus_suffix }}"
|
|
@ -53,7 +53,7 @@
|
|||
</Location>
|
||||
|
||||
<IfModule mod_status.c>
|
||||
<Location /server-status>
|
||||
<Location /server-status-{{ apache_serverstatus_suffix | mandatory }}>
|
||||
SetHandler server-status
|
||||
include /etc/apache2/ipaddr_whitelist.conf
|
||||
Require local
|
||||
|
@ -112,7 +112,7 @@
|
|||
LogLevel warn
|
||||
|
||||
<IfModule mod_status.c>
|
||||
<Location /server-status>
|
||||
<Location /server-status-{{ apache_serverstatus_suffix | mandatory }}>
|
||||
SetHandler server-status
|
||||
include /etc/apache2/ipaddr_whitelist.conf
|
||||
Require local
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
/var/log/bind.log {
|
||||
weekly
|
||||
missingok
|
||||
rotate 8
|
||||
rotate 52
|
||||
create 640 bind bind
|
||||
sharedscripts
|
||||
postrotate
|
||||
|
|
|
@ -11,4 +11,5 @@ CRT_DIR="${CRT_DIR:-'/etc/letsencrypt'}"
|
|||
|
||||
export QUIET=1
|
||||
|
||||
find "${CRT_DIR}" -maxdepth 1 -mindepth 1 -type d ! -path "*accounts" ! -path "*hooks" -printf "%f\n" | xargs -n1 evoacme
|
||||
find "${CRT_DIR}" -maxdepth 1 -mindepth 1 -type d ! -path "*accounts" ! -path "*hooks" -printf "%f\n" \
|
||||
| xargs --max-args=1 --no-run-if-empty evoacme
|
||||
|
|
|
@ -4,6 +4,9 @@
|
|||
# Script to verify compliance of a Debian/OpenBSD server
|
||||
# powered by Evolix
|
||||
|
||||
# Repository: https://gitlab.evolix.org/evolix/evocheck
|
||||
# Commit: c99324488553a745a201022d44f8f78f224631eb
|
||||
|
||||
# Disable LANG*
|
||||
export LANG=C
|
||||
export LANGUAGE=C
|
||||
|
@ -72,6 +75,31 @@ IS_MUNINRUNNING=1
|
|||
IS_BACKUPUPTODATE=1
|
||||
IS_GITPERMS=1
|
||||
IS_NOTUPGRADED=1
|
||||
IS_TUNE2FS_M5=1
|
||||
IS_PRIVKEYWOLRDREADABLE=1
|
||||
IS_EVOLINUXSUDOGROUP=1
|
||||
IS_USERINADMGROUP=1
|
||||
IS_APACHE2EVOLINUXCONF=1
|
||||
IS_BACKPORTSCONF=1
|
||||
IS_BIND9MUNIN=1
|
||||
IS_BIND9LOGROTATE=1
|
||||
IS_BROADCOMFIRMWARE=1
|
||||
IS_HARDWARERAIDTOOL=1
|
||||
IS_LOG2MAILSYSTEMDUNIT=1
|
||||
IS_LISTUPGRADE=1
|
||||
IS_MARIADBEVOLINUXCONF=1
|
||||
IS_MARIADBSYSTEMDUNIT=1
|
||||
IS_MYSQLMUNIN=1
|
||||
IS_PHPEVOLINUXCONF=1
|
||||
IS_SQUIDLOGROTATE=1
|
||||
IS_SQUIDEVOLINUXCONF=1
|
||||
IS_SQL_BACKUP=1
|
||||
IS_POSTGRES_BACKUP=1
|
||||
IS_LDAP_BACKUP=1
|
||||
IS_REDIS_BACKUP=1
|
||||
IS_ELASTIC_BACKUP=1
|
||||
IS_MONGO_BACKUP=1
|
||||
IS_MOUNT_FSTAB=1
|
||||
|
||||
#Proper to OpenBSD
|
||||
IS_SOFTDEP=1
|
||||
|
@ -100,7 +128,7 @@ fi
|
|||
|
||||
# Functions
|
||||
is_pack_web(){
|
||||
test -e /usr/share/scripts/web-add.sh
|
||||
test -e /usr/share/scripts/web-add.sh || test -e /usr/share/scripts/evoadmin/web-add.sh
|
||||
}
|
||||
|
||||
is_pack_samba(){
|
||||
|
@ -114,7 +142,7 @@ is_installed(){
|
|||
}
|
||||
|
||||
is_debianversion(){
|
||||
[ $(lsb_release -c -s) = $1 ] && return 0;
|
||||
[ $(lsb_release -c -s) = $1 ] && return 0
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------
|
||||
|
@ -130,6 +158,7 @@ if [ -e /etc/debian_version ]; then
|
|||
is_debianversion wheezy && ( ( [ "$IS_USRRO" = 1 ] || [ "$IS_TMPNOEXEC" = 1 ] ) && \
|
||||
( test -e /etc/apt/apt.conf.d/80evolinux || echo 'IS_DPKGWARNING FAILED!' )
|
||||
test -e /etc/apt/apt.conf && echo 'IS_DPKGWARNING FAILED!' )
|
||||
is_debianversion stretch && (test -e /etc/apt/apt.conf.d/z-evolinux.conf || echo 'IS_DPKGWARNING FAILED!')
|
||||
fi
|
||||
|
||||
if [ "$IS_UMASKSUDOERS" = 1 ]; then
|
||||
|
@ -139,7 +168,7 @@ if [ -e /etc/debian_version ]; then
|
|||
# Verifying check_mailq in Nagios NRPE config file. (Option "-M postfix" need to be set if the MTA is Postfix)
|
||||
if [ "$IS_NRPEPOSTFIX" = 1 ]; then
|
||||
is_debianversion squeeze && is_installed postfix && ( grep -q "^command.*check_mailq -M postfix" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPOSTFIX FAILED!' )
|
||||
is_debianversion squeeze || ( is_installed postfix && ( grep -qr "^command.*check_mailq -M postfix" /etc/nagios/nrpe.* || echo 'IS_NRPEPOSTFIX FAILED!' ) )
|
||||
is_debianversion squeeze || ( is_installed postfix && ( test -e /etc/nagios/nrpe.cfg && grep -qr "^command.*check_mailq -M postfix" /etc/nagios/nrpe.* || echo 'IS_NRPEPOSTFIX FAILED!' ) )
|
||||
fi
|
||||
|
||||
# Check if mod-security config file is present
|
||||
|
@ -181,10 +210,12 @@ if [ -e /etc/debian_version ]; then
|
|||
|
||||
if [ "$IS_APTITUDE" = 1 ]; then
|
||||
is_debianversion jessie && test -e /usr/bin/aptitude && echo 'IS_APTITUDE FAILED!'
|
||||
is_debianversion stretch && test -e /usr/bin/aptitude && echo 'IS_APTITUDE FAILED!'
|
||||
fi
|
||||
|
||||
if [ "$IS_APTGETBAK" = 1 ]; then
|
||||
is_debianversion jessie && test -e /usr/bin/apt-get.bak && echo 'IS_APTGETBAK FAILED!'
|
||||
is_debianversion stretch && test -e /usr/bin/apt-get.bak && echo 'IS_APTGETBAK FAILED!'
|
||||
fi
|
||||
|
||||
if [ "$IS_APTICRON" = 1 ]; then
|
||||
|
@ -203,8 +234,21 @@ if [ -e /etc/debian_version ]; then
|
|||
mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!'
|
||||
fi
|
||||
|
||||
if [ "$IS_MOUNT_FSTAB" = 1 ]; then
|
||||
# Test if lsblk available, if not skip this test...
|
||||
if test -x "$(command -v lsblk)"; then
|
||||
for mountPoint in $(lsblk -o MOUNTPOINT -l -n | grep '/'); do
|
||||
grep -Eq "$mountPoint\W" /etc/fstab || echo 'IS_MOUNT_FSTAB FAILED!'
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_LISTCHANGESCONF" = 1 ]; then
|
||||
is_debianversion stretch || ( test -e /etc/apt/listchanges.conf && egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!' )
|
||||
if is_debianversion stretch; then
|
||||
is_installed apt-listchanges && echo 'IS_LISTCHANGESCONF FAILED!'
|
||||
else
|
||||
test -e /etc/apt/listchanges.conf && egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_CUSTOMCRONTAB" = 1 ]; then
|
||||
|
@ -236,13 +280,14 @@ if [ -e /etc/debian_version ]; then
|
|||
fi
|
||||
|
||||
if [ "$IS_NRPEPERMS" = 1 ]; then
|
||||
ls -ld /etc/nagios | grep -q drwxr-x--- || echo 'IS_NRPEPERMS FAILED!'
|
||||
test -d /etc/nagios && ls -ld /etc/nagios | grep -q drwxr-x--- || echo 'IS_NRPEPERMS FAILED!'
|
||||
fi
|
||||
|
||||
if [ "$IS_MINIFWPERMS" = 1 ]; then
|
||||
is_debianversion squeeze && ( ls -l /etc/firewall.rc | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
|
||||
is_debianversion wheezy && ( ls -l /etc/firewall.rc | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
|
||||
is_debianversion jessie && ( ls -l /etc/default/minifirewall | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
|
||||
is_debianversion stretch && ( ls -l /etc/default/minifirewall | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' )
|
||||
fi
|
||||
|
||||
if [ "$IS_NRPEDISKS" = 1 ]; then
|
||||
|
@ -252,7 +297,7 @@ if [ -e /etc/debian_version ]; then
|
|||
fi
|
||||
|
||||
if [ "$IS_NRPEPID" = 1 ]; then
|
||||
! is_debianversion squeeze && (grep -q "^pid_file=/var/run/nagios/nrpe.pid" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPID FAILED!')
|
||||
is_debianversion squeeze || (test -e /etc/nagios/nrpe.cfg && grep -q "^pid_file=/var/run/nagios/nrpe.pid" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPID FAILED!')
|
||||
fi
|
||||
|
||||
if [ "$IS_GRSECPROCS" = 1 ]; then
|
||||
|
@ -260,12 +305,13 @@ if [ -e /etc/debian_version ]; then
|
|||
fi
|
||||
|
||||
if [ "$IS_APACHEMUNIN" = 1 ]; then
|
||||
test -e /etc/apache2/apache2.conf && ( egrep -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' )
|
||||
test -e /etc/apache2/apache2.conf && ( is_debianversion stretch || ( egrep -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' ) )
|
||||
test -e /etc/apache2/apache2.conf && ( is_debianversion stretch && ( test -h /etc/apache2/mods-enabled/status.load && test -h /etc/munin/plugins/apache_accesses && test -h /etc/munin/plugins/apache_processes && test -h /etc/munin/plugins/apache_accesses || echo 'IS_APACHEMUNIN FAILED!' ) )
|
||||
fi
|
||||
|
||||
# Verification mytop + Munin si MySQL
|
||||
if [ "$IS_MYSQLUTILS" = 1 ]; then
|
||||
is_installed mysql-server && ( grep -q mysqladmin /root/.my.cnf && is_installed mytop && grep -q debian-sys-maint /root/.mytop || echo 'IS_MYSQLUTILS FAILED!' )
|
||||
is_installed mysql-server && ( grep -q mysqladmin /root/.my.cnf && test -x /usr/bin/mytop && grep -q debian-sys-maint /root/.mytop || echo 'IS_MYSQLUTILS FAILED!' )
|
||||
fi
|
||||
|
||||
# Verification de la configuration du raid soft (mdadm)
|
||||
|
@ -293,14 +339,16 @@ if [ -e /etc/debian_version ]; then
|
|||
|
||||
# Verification de l'activation de Squid dans le cas d'un pack mail
|
||||
if [ "$IS_SQUID" = 1 ]; then
|
||||
squidconffile=/etc/squid*/squid.conf
|
||||
is_debianversion squeeze && f=/etc/firewall.rc
|
||||
is_debianversion wheezy && f=/etc/firewall.rc
|
||||
is_debianversion jessie && f=/etc/default/minifirewall
|
||||
is_debianversion stretch && f=/etc/default/minifirewall && squidconffile=/etc/squid/evolinux-custom.conf
|
||||
is_pack_web && ( is_installed squid || is_installed squid3 \
|
||||
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner proxy -j ACCEPT" $f \
|
||||
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d `hostname -i` -j ACCEPT" $f \
|
||||
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.(1|0/8) -j ACCEPT" $f \
|
||||
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port.* `grep http_port /etc/squid*/squid.conf |cut -f 2 -d " "`" $f || echo 'IS_SQUID FAILED!' )
|
||||
&& grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port.* `grep http_port $squidconffile | cut -f 2 -d " "`" $f || echo 'IS_SQUID FAILED!' )
|
||||
fi
|
||||
|
||||
# Verification de la conf et de l'activation de mod-deflate
|
||||
|
@ -316,10 +364,15 @@ if [ -e /etc/debian_version ]; then
|
|||
is_pack_web && (is_installed log2mail && pgrep log2mail >/dev/null || echo 'IS_LOG2MAILRUNNING')
|
||||
fi
|
||||
if [ "$IS_LOG2MAILAPACHE" = 1 ]; then
|
||||
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/apache2/error.log" /etc/log2mail/config/default 2>/dev/null || echo 'IS_LOG2MAILAPACHE FAILED!' )
|
||||
if is_debianversion stretch; then
|
||||
conf=/etc/log2mail/config/apache
|
||||
else
|
||||
conf=/etc/log2mail/config/default
|
||||
fi
|
||||
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/apache2/error.log" $conf 2>/dev/null || echo 'IS_LOG2MAILAPACHE FAILED!' )
|
||||
fi
|
||||
if [ "$IS_LOG2MAILMYSQL" = 1 ]; then
|
||||
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/syslog" /etc/log2mail/config/default 2>/dev/null || echo 'IS_LOG2MAILMYSQL FAILED!' )
|
||||
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/syslog" /etc/log2mail/config/{default,mysql,mysql.conf} 2>/dev/null || echo 'IS_LOG2MAILMYSQL FAILED!' )
|
||||
fi
|
||||
if [ "$IS_LOG2MAILSQUID" = 1 ]; then
|
||||
is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/squid.*/access.log" \
|
||||
|
@ -347,7 +400,10 @@ if [ -e /etc/debian_version ]; then
|
|||
|
||||
# Verify if all if are in auto
|
||||
if [ "$IS_AUTOIF" = 1 ]; then
|
||||
for interface in `/sbin/ifconfig -s |tail -n +2 |egrep -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" |cut -d " " -f 1 |tr "\n" " "`; do
|
||||
is_debianversion stretch || for interface in `/sbin/ifconfig -s |tail -n +2 |egrep -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" |cut -d " " -f 1 |tr "\n" " "`; do
|
||||
grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break)
|
||||
done
|
||||
is_debianversion stretch && for interface in `/sbin/ip address show up | grep ^[0-9]*: |egrep -v "(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 2 |tr -d : |cut -d@ -f1 |tr "\n" " "`; do
|
||||
grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break)
|
||||
done
|
||||
fi
|
||||
|
@ -386,7 +442,7 @@ if [ -e /etc/debian_version ]; then
|
|||
if [ "$IS_APACHEIPINALLOW" = 1 ]; then
|
||||
# Note: Replace "exit 1" by "print" in Perl code to debug it.
|
||||
is_installed apache2.2-common && \
|
||||
(grep -IrE "^[^#] *(Allow|Deny) from" /etc/apache2/ |grep -iv "from all" |perl -ne 'exit 1 unless (/from( [\da-f:.\/]+)+$/i)' || echo 'IS_APACHEIPINALLOW FAILED!')
|
||||
(grep -IrE "^[^#] *(Allow|Deny) from" /etc/apache2/ |grep -iv "from all" |grep -iv "env=" |perl -ne 'exit 1 unless (/from( [\da-f:.\/]+)+$/i)' || echo 'IS_APACHEIPINALLOW FAILED!')
|
||||
fi
|
||||
|
||||
# Check if default Apache configuration file for munin is absent (or empty or commented).
|
||||
|
@ -437,7 +493,7 @@ if [ -e /etc/debian_version ]; then
|
|||
|
||||
# Check if /etc/.git/ has read/write permissions for root only.
|
||||
if [ "$IS_GITPERMS" = 1 ]; then
|
||||
[ "$(stat -c "%a" /etc/.git/)" = "700" ] || echo 'IS_GITPERMS FAILED!'
|
||||
test -d /etc/.git && [ "$(stat -c "%a" /etc/.git/)" = "700" ] || echo 'IS_GITPERMS FAILED!'
|
||||
fi
|
||||
|
||||
# Check if no package has been upgraded since $limit.
|
||||
|
@ -452,6 +508,205 @@ if [ -e /etc/debian_version ]; then
|
|||
[ $install_date -lt $limit ] && [ $last_upgrade -lt $limit ] && echo 'IS_NOTUPGRADED FAILED!'
|
||||
fi
|
||||
|
||||
# Check if reserved blocks for root is at least 5% on every mounted partitions.
|
||||
if [ "$IS_TUNE2FS_M5" = 1 ]; then
|
||||
parts=$(grep -E "ext(3|4)" /proc/mounts | cut -d ' ' -f1 | tr -s '\n' ' ')
|
||||
for part in $parts; do
|
||||
blockCount=$(dumpe2fs -h "$part" 2>/dev/null | grep -e "Block count:" | grep -Eo "[0-9]+")
|
||||
# If buggy partition, skip it.
|
||||
if [ -z $blockCount ]; then
|
||||
continue
|
||||
fi
|
||||
reservedBlockCount=$(dumpe2fs -h "$part" 2>/dev/null | grep -e "Reserved block count:" | grep -Eo "[0-9]+")
|
||||
percentage=$(python -c "print(int(round(float(${reservedBlockCount})/${blockCount}*100)))")
|
||||
if [ "$percentage" -lt 5 ]; then
|
||||
echo 'IS_TUNE2FS_M5 FAILED!'
|
||||
# Set debug to 1, to displays which partitions has less than 5%
|
||||
debug=0
|
||||
if [ "$debug" -eq 1 ]; then
|
||||
echo "Partition $part has less than 5% reserved blocks!"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [ "$IS_EVOLINUXSUDOGROUP" = 1 ]; then
|
||||
if is_debianversion stretch; then
|
||||
(grep -q ^evolinux-sudo: /etc/group \
|
||||
&& grep -q '^%evolinux-sudo ALL=(ALL:ALL) ALL' /etc/sudoers.d/evolinux) || echo 'IS_EVOLINUXSUDOGROUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_USERINADMGROUP" = 1 ]; then
|
||||
if is_debianversion stretch; then
|
||||
for user in $(grep ^evolinux-sudo: /etc/group |awk -F: '{print $4}' |tr ',' ' '); do
|
||||
groups $user |grep -q adm || echo 'IS_USERINADMGROUP FAILED!'
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_APACHE2EVOLINUXCONF" = 1 ]; then
|
||||
if (test -d /etc/apache2 && is_debianversion stretch); then
|
||||
(test -L /etc/apache2/conf-enabled/z-evolinux-defaults.conf \
|
||||
&& test -L /etc/apache2/conf-enabled/zzz-evolinux-custom.conf \
|
||||
&& test -f /etc/apache2/ipaddr_whitelist.conf) || echo 'IS_APACHE2EVOLINUXCONF FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_BACKPORTSCONF" = 1 ]; then
|
||||
if is_debianversion stretch; then
|
||||
grep -q backports /etc/apt/sources.list && echo 'IS_BACKPORTSCONF FAILED!'
|
||||
grep -q backports /etc/apt/sources.list.d/*.list && (grep -q backports /etc/apt/preferences.d/* || echo 'IS_BACKPORTSCONF FAILED!')
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_BIND9MUNIN" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed bind9; then
|
||||
(test -L /etc/munin/plugins/bind9 && test -e /etc/munin/plugin-conf.d/bind9) || echo 'IS_BIND9MUNIN FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_BIND9LOGROTATE" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed bind9; then
|
||||
test -e /etc/logrotate.d/bind9 || echo 'IS_BIND9LOGROTATE FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_BROADCOMFIRMWARE" = 1 ]; then
|
||||
if lspci | grep -q 'NetXtreme II'; then
|
||||
(is_installed firmware-bnx2 && grep -q "^deb http://mirror.evolix.org/debian.* non-free" /etc/apt/sources.list) || echo 'IS_BROADCOMFIRMWARE FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_HARDWARERAIDTOOL" = 1 ]; then
|
||||
lspci |grep -q 'MegaRAID SAS' && (is_installed megacli && (is_installed megaclisas-status || is_installed megaraidsas-status) || echo 'IS_HARDWARERAIDTOOL FAILED!')
|
||||
lspci |grep -q 'Hewlett-Packard Company Smart Array' && (is_installed cciss-vol-status || echo 'IS_HARDWARERAIDTOOL FAILED!')
|
||||
fi
|
||||
|
||||
if [ "$IS_LOG2MAILSYSTEMDUNIT" = 1 ]; then
|
||||
if is_debianversion stretch; then
|
||||
(systemctl -q is-active log2mail.service && test -f /etc/systemd/system/log2mail.service && ! test -f /etc/init.d/log2mail) || echo 'IS_LOG2MAILSYSTEMDUNIT FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_LISTUPGRADE" = 1 ]; then
|
||||
(test -f /etc/cron.d/listupgrade && test -x /usr/share/scripts/listupgrade.sh) || echo 'IS_LISTUPGRADE FAILED!'
|
||||
fi
|
||||
|
||||
if [ "$IS_MARIADBEVOLINUXCONF" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed mariadb-server; then
|
||||
(test -f /etc/mysql/mariadb.conf.d/z-evolinux-defaults.cnf \
|
||||
&& test -f /etc/mysql/mariadb.conf.d/zzz-evolinux-custom.cnf) || echo 'IS_MARIADBEVOLINUXCONF FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_SQL_BACKUP" = 1 ]; then
|
||||
if (is_installed "mysql-server" || is_installed "mariadb-server"); then
|
||||
# You could change the default path in /etc/evocheck.cf
|
||||
SQL_BACKUP_PATH=${SQL_BACKUP_PATH:-"/home/backup/mysql.bak.gz"}
|
||||
test -f "$SQL_BACKUP_PATH" || echo 'IS_SQL_BACKUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_POSTGRES_BACKUP" = 1 ]; then
|
||||
if is_installed "postgresql-9*"; then
|
||||
# If you use something like barman, you should deactivate this check
|
||||
# You could change the default path in /etc/evocheck.cf
|
||||
POSTGRES_BACKUP_PATH=${POSTGRES_BACKUP_PATH:-"/home/backup/pg.dump.bak"}
|
||||
test -f "$POSTGRES_BACKUP_PATH" || echo 'IS_POSTGRES_BACKUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_MONGO_BACKUP" = 1 ]; then
|
||||
if is_installed "mongodb-org-server"; then
|
||||
# You could change the default path in /etc/evocheck.cf
|
||||
MONGO_BACKUP_PATH=${MONGO_BACKUP_PATH:-"/home/backup/mongodump"}
|
||||
if [ -d "$MONGO_BACKUP_PATH" ]; then
|
||||
for file in ${MONGO_BACKUP_PATH}/*/*.{json,bson}; do
|
||||
# Skip indexes file.
|
||||
if ! [[ "$file" =~ indexes ]]; then
|
||||
if [ -f $file ] && [ $(stat -c "%Y" $file) -lt $(date +"%s" -d "now - 2 day") ]; then
|
||||
echo 'IS_MONGO_BACKUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
done
|
||||
else
|
||||
echo 'IS_MONGO_BACKUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_LDAP_BACKUP" = 1 ]; then
|
||||
if is_installed slapd; then
|
||||
# You could change the default path in /etc/evocheck.cf
|
||||
LDAP_BACKUP_PATH=${LDAP_BACKUP_PATH:-"/home/backup/ldap.bak"}
|
||||
test -f "$LDAP_BACKUP_PATH" || echo 'IS_LDAP_BACKUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_REDIS_BACKUP" = 1 ]; then
|
||||
if is_installed redis-server; then
|
||||
# You could change the default path in /etc/evocheck.cf
|
||||
REDIS_BACKUP_PATH=${REDIS_BACKUP_PATH:-"/home/backup/dump.rdb"}
|
||||
test -f "$REDIS_BACKUP_PATH" || echo 'IS_REDIS_BACKUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_ELASTIC_BACKUP" = 1 ]; then
|
||||
if is_installed elasticsearch; then
|
||||
# You could change the default path in /etc/evocheck.cf
|
||||
ELASTIC_BACKUP_PATH=${ELASTIC_BACKUP_PATH:-"/home/backup/elasticsearch"}
|
||||
test -d "$ELASTIC_BACKUP_PATH" || echo 'IS_ELASTIC_BACKUP FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_MARIADBSYSTEMDUNIT" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed mariadb-server; then
|
||||
(systemctl -q is-active mariadb.service && test -f /etc/systemd/system/mariadb.service.d/evolinux.conf) || echo 'IS_MARIADBSYSTEMDUNIT FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_MYSQLMUNIN" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed mariadb-server; then
|
||||
for file in mysql_bytes mysql_queries mysql_slowqueries mysql_threads mysql_connections mysql_files_tables mysql_innodb_bpool mysql_innodb_bpool_act mysql_innodb_io mysql_innodb_log mysql_innodb_rows mysql_innodb_semaphores mysql_myisam_indexes mysql_qcache mysql_qcache_mem mysql_sorts mysql_tmp_tables; do
|
||||
test -L /etc/munin/plugins/$file || echo 'IS_MYSQLMUNIN FAILED!'
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_MYSQLNRPE" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed mariadb-server; then
|
||||
(test -f ~nagios/.my.cnf \
|
||||
&& [ $(stat -c %U ~nagios/.my.cnf) = "nagios" ] \
|
||||
&& [ $(stat -c %a ~nagios/.my.cnf) = "600" ] \
|
||||
&& grep -q -F "command[check_mysql]=/usr/lib/nagios/plugins/check_mysql -H localhost -f ~nagios/.my.cnf") || echo 'IS_MYSQLNRPE FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_PHPEVOLINUXCONF" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed php; then
|
||||
(test -f /etc/php/7.0/cli/conf.d/z-evolinux-defaults.ini \
|
||||
&& test -f /etc/php/7.0/cli/conf.d/zzz-evolinux-custom.ini) || echo 'IS_PHPEVOLINUXCONF FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_SQUIDLOGROTATE" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed squid; then
|
||||
grep -q monthly /etc/logrotate.d/squid || echo 'IS_SQUIDLOGROTATE FAILED!'
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$IS_SQUIDEVOLINUXCONF" = 1 ]; then
|
||||
if is_debianversion stretch && is_installed squid; then
|
||||
(grep -q "^CONFIG=/etc/squid/evolinux-defaults.conf$" /etc/default/squid \
|
||||
&& test -f /etc/squid/evolinux-defaults.conf \
|
||||
&& test -f /etc/squid/evolinux-whitelist-defaults.conf \
|
||||
&& test -f /etc/squid/evolinux-whitelist-custom.conf \
|
||||
&& test -f /etc/squid/evolinux-acl.conf \
|
||||
&& test -f /etc/squid/evolinux-httpaccess.conf \
|
||||
&& test -f /etc/squid/evolinux-custom.conf) || echo 'IS_SQUIDEVOLINUXCONF FAILED!'
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
|
@ -561,10 +816,12 @@ if [ "$IS_USRSHARESCRIPTS" = 1 ]; then
|
|||
fi
|
||||
|
||||
if [ "$IS_SSHPERMITROOTNO" = 1 ]; then
|
||||
egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!'
|
||||
is_debianversion stretch || ( egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
|
||||
is_debianversion stretch && grep -q ^PermitRoot /etc/ssh/sshd_config && ( egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
|
||||
fi
|
||||
|
||||
if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
|
||||
if ! is_debianversion stretch; then
|
||||
if [ -f /etc/sudoers.d/evolinux ]; then
|
||||
sudoers="/etc/sudoers.d/evolinux"
|
||||
else
|
||||
|
@ -573,12 +830,19 @@ if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
|
|||
for i in $( (grep "^User_Alias *ADMIN" $sudoers | cut -d= -f2 | tr -d " "; grep ^sudo /etc/group |cut -d: -f 4) | tr "," "\n" |sort -u); do
|
||||
grep -q "^trap.*sudo.*evomaintenance.sh" /home/$i/.*profile || echo 'IS_EVOMAINTENANCEUSERS FAILED!'
|
||||
done
|
||||
else
|
||||
for i in $(getent group evolinux-sudo | cut -d':' -f4 | tr ',' ' '); do
|
||||
grep -q "^trap.*sudo.*evomaintenance.sh" /home/$i/.*profile || echo 'IS_EVOMAINTENANCEUSERS FAILED!'
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
# Verification de la configuration d'evomaintenance
|
||||
if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
|
||||
f=/etc/evomaintenance.cf
|
||||
( grep "^export PGPASSWORD" $f |grep -qv "your-passwd" \
|
||||
( test -e $f \
|
||||
&& test $(stat -c "%a" $f) = "600" \
|
||||
&& grep "^export PGPASSWORD" $f |grep -qv "your-passwd" \
|
||||
&& grep "^PGDB" $f |grep -qv "your-db" \
|
||||
&& grep "^PGTABLE" $f |grep -qv "your-table" \
|
||||
&& grep "^PGHOST" $f |grep -qv "your-pg-host" \
|
||||
|
@ -588,3 +852,12 @@ if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
|
|||
&& grep "^URGENCYTEL" $f |grep -qv "06.00.00.00.00" \
|
||||
&& grep "^REALM" $f |grep -qv "example.com" ) || echo 'IS_EVOMAINTENANCECONF FAILED!'
|
||||
fi
|
||||
|
||||
if [ "$IS_PRIVKEYWOLRDREADABLE" = 1 ]; then
|
||||
for f in /etc/ssl/private/*; do
|
||||
perms=$(stat -c "%a" $f)
|
||||
if [ ${perms: -1} != "0" ]; then
|
||||
echo 'IS_PRIVKEYWOLRDREADABLE FAILED!'
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
|
|
@ -2,6 +2,8 @@
|
|||
- include_role:
|
||||
name: remount-usr
|
||||
when: evocheck_bin_dir | search ("/usr")
|
||||
tags:
|
||||
- evocheck
|
||||
|
||||
- name: Scripts dir is present
|
||||
file:
|
||||
|
@ -10,6 +12,8 @@
|
|||
owner: root
|
||||
group: root
|
||||
mode: "0700"
|
||||
tags:
|
||||
- evocheck
|
||||
|
||||
- name: Copy evocheck.sh
|
||||
copy:
|
||||
|
|
|
@ -21,6 +21,10 @@ evolinux_apt_public_sources: True
|
|||
evolinux_apt_upgrade: True
|
||||
evolinux_apt_remove_aptitude: True
|
||||
|
||||
# etc-evolinux
|
||||
|
||||
evolinux_etcevolinux_include: True
|
||||
|
||||
# etc-git
|
||||
|
||||
evolinux_etcgit_include: True
|
||||
|
@ -72,6 +76,7 @@ evolinux_packages_common: True
|
|||
evolinux_packages_stretch: True
|
||||
evolinux_packages_serveur_base: True
|
||||
evolinux_packages_purge_openntpd: True
|
||||
evolinux_packages_purge_locate: True
|
||||
evolinux_packages_invalid_mta: True
|
||||
evolinux_packages_delete_nfs: True
|
||||
evolinux_packages_listchanges: True
|
||||
|
|
9
evolinux-base/tasks/etc-evolinux.yml
Normal file
9
evolinux-base/tasks/etc-evolinux.yml
Normal file
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
|
||||
- name: /etc/evolinux exists
|
||||
file:
|
||||
dest: /etc/evolinux
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0700"
|
||||
state: directory
|
|
@ -19,6 +19,10 @@
|
|||
name: etc-git
|
||||
when: evolinux_etcgit_include
|
||||
|
||||
- name: /etc/evolinux base
|
||||
include: etc-evolinux.yml
|
||||
when: evolinux_etcevolinux_include
|
||||
|
||||
- name: Hostname
|
||||
include: hostname.yml
|
||||
when: evolinux_hostname_include
|
||||
|
|
|
@ -67,6 +67,16 @@
|
|||
purge: yes
|
||||
when: evolinux_packages_purge_openntpd
|
||||
|
||||
- name: Be sure locate/mlocate is absent/purged
|
||||
apt:
|
||||
name: "{{ item }}"
|
||||
state: absent
|
||||
purge: yes
|
||||
with_items:
|
||||
- locate
|
||||
- mlocate
|
||||
when: evolinux_packages_purge_locate
|
||||
|
||||
- name: Install/Update serveur-base meta-package
|
||||
apt:
|
||||
name: serveur-base
|
||||
|
|
|
@ -58,7 +58,7 @@
|
|||
|
||||
<ul id="evolinks">
|
||||
<li><a href="/munin/{{ ansible_domain }}/{{ ansible_fqdn }}/">Stats système</a></li>
|
||||
<li><a href="/server-status">Server Status</a></li>
|
||||
<li><a href="/server-status-__SERVERSTATUS_SUFFIX__">Server Status</a></li>
|
||||
<!-- <li><a href="/phpmyadmin-__PHPMYADMIN_SUFFIX__/">Accès PhpMyAdmin</a></li> -->
|
||||
<!-- <li><a href="/mysqlreport.html">Dernier rapport MySQL Tuner</a></li> -->
|
||||
<!-- <li><a href="/cgi-bin/awstats.pl">Stats web</a></li> -->
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
|
||||
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
|
||||
- name: "Verify 'evolinux' sudoers file presence (Debian 9 or later)"
|
||||
template:
|
||||
src: sudoers_stretch.j2
|
||||
dest: /etc/sudoers.d/evolinux
|
||||
|
@ -8,13 +8,19 @@
|
|||
validate: '/usr/sbin/visudo -cf %s'
|
||||
register: copy_sudoers_evolinux
|
||||
|
||||
- name: "Create evolinux-sudo group (Debian 9 or later)"
|
||||
- name: "Create '{{ evolinux_sudo_group }}' group (Debian 9 or later)"
|
||||
group:
|
||||
name: "{{ evolinux_sudo_group }}"
|
||||
system: yes
|
||||
|
||||
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
|
||||
- name: "Add user to '{{ evolinux_sudo_group }}' group (Debian 9 or later)"
|
||||
user:
|
||||
name: '{{ user.name }}'
|
||||
groups: "{{ evolinux_sudo_group }}"
|
||||
append: yes
|
||||
|
||||
- name: "Add user to 'adm' group (Debian 9 or later)"
|
||||
user:
|
||||
name: '{{ user.name }}'
|
||||
groups: "adm"
|
||||
append: yes
|
||||
|
|
|
@ -3,30 +3,45 @@
|
|||
include_role:
|
||||
name: apt
|
||||
tasks_from: evolix_public.yml
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
- name: evomaintenance is installed
|
||||
apt:
|
||||
name: evomaintenance
|
||||
allow_unauthenticated: yes
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
- name: configuration is applied
|
||||
template:
|
||||
src: evomaintenance.j2
|
||||
dest: /etc/evomaintenance.cf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
# - name: list users with a shell
|
||||
# shell: "cat /etc/passwd | grep -vE \"^root:\" | grep -E \":/[^:]+sh$\" | cut -d: -f6"
|
||||
# changed_when: False
|
||||
# check_mode: no
|
||||
# register: home_of_shell_users
|
||||
# tags:
|
||||
# - evomaintenance
|
||||
#
|
||||
# - include: trap.yml home={{ item }}
|
||||
# with_items: "{{ home_of_shell_users.stdout_lines }}"
|
||||
# tags:
|
||||
# - evomaintenance
|
||||
|
||||
- name: Is minifirewall installed?
|
||||
stat:
|
||||
path: /etc/default/minifirewall
|
||||
register: minifirewall_default_file
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
- name: minifirewall section for evomaintenance
|
||||
lineinfile:
|
||||
|
@ -35,6 +50,8 @@
|
|||
insertafter: "^# EvoMaintenance"
|
||||
with_items: "{{ evomaintenance_hosts }}"
|
||||
when: minifirewall_default_file.stat.exists
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
- name: remove minifirewall example rule for the proxy
|
||||
lineinfile:
|
||||
|
@ -42,3 +59,5 @@
|
|||
regexp: '^#.*(--sport 5432).*(-s X\.X\.X\.X)'
|
||||
state: absent
|
||||
when: minifirewall_default_file.stat.exists
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
|
|
@ -3,6 +3,8 @@
|
|||
path: "{{ home }}/.bash_profile"
|
||||
check_mode: no
|
||||
register: bash_profile
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
- name: install shell trap in {{ home }}/.bash_profile
|
||||
lineinfile:
|
||||
|
@ -11,6 +13,8 @@
|
|||
insertafter: EOF
|
||||
create: no
|
||||
when: bash_profile.stat.exists
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
- name: is {{ home }}/.profile present?
|
||||
stat:
|
||||
|
@ -18,6 +22,8 @@
|
|||
check_mode: no
|
||||
register: profile
|
||||
when: not bash_profile.stat.exists
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
||||
- name: install shell trap in {{ home }}/.profile
|
||||
lineinfile:
|
||||
|
@ -26,3 +32,5 @@
|
|||
insertafter: EOF
|
||||
create: yes
|
||||
when: not bash_profile.stat.exists
|
||||
tags:
|
||||
- evomaintenance
|
||||
|
|
|
@ -1,13 +1,13 @@
|
|||
HOSTNAME={{ evomaintenance_hostname }}
|
||||
EVOMAINTMAIL={{ evomaintenance_alert_email or general_alert_email | mandatory }}
|
||||
HOSTNAME="{{ evomaintenance_hostname }}"
|
||||
EVOMAINTMAIL="{{ evomaintenance_alert_email or general_alert_email | mandatory }}"
|
||||
|
||||
export PGPASSWORD={{ evomaintenance_pg_passwd }}
|
||||
export PGPASSWORD="{{ evomaintenance_pg_passwd }}"
|
||||
|
||||
PGDB={{ evomaintenance_pg_db }}
|
||||
PGTABLE={{ evomaintenance_pg_table }}
|
||||
PGHOST={{ evomaintenance_pg_host }}
|
||||
FROM={{ evomaintenance_from }}
|
||||
PGDB="{{ evomaintenance_pg_db }}"
|
||||
PGTABLE="{{ evomaintenance_pg_table }}"
|
||||
PGHOST="{{ evomaintenance_pg_host }}"
|
||||
FROM="{{ evomaintenance_from }}"
|
||||
FULLFROM="{{ evomaintenance_full_from }}"
|
||||
URGENCYFROM={{ evomaintenance_urgency_from }}
|
||||
URGENCYFROM="{{ evomaintenance_urgency_from }}"
|
||||
URGENCYTEL="{{ evomaintenance_urgency_tel }}"
|
||||
REALM={{ evomaintenance_realm }}
|
||||
REALM="{{ evomaintenance_realm }}"
|
||||
|
|
|
@ -16,4 +16,6 @@ nginx_default_redirect_url: "http://evolix.fr"
|
|||
nginx_evolinux_default_enabled: True
|
||||
|
||||
# nginx_phpmyadmin_suffix: ""
|
||||
# nginx_serverstatus_suffix: ""
|
||||
|
||||
nginx_serverstatus_suffix: ""
|
||||
nginx_serverstatus_suffix_file: "/etc/evolinux/nginx_serverstatus_suffix"
|
||||
|
|
|
@ -1,6 +1,10 @@
|
|||
---
|
||||
|
||||
- name: logrotate configuration
|
||||
copy:
|
||||
src: logrotate_nginx
|
||||
dest: /etc/logrotate.d/nginx
|
||||
force: no
|
||||
tags:
|
||||
- nginx
|
||||
- logrotate
|
||||
|
|
|
@ -107,6 +107,10 @@
|
|||
tags:
|
||||
- nginx
|
||||
|
||||
- include: server_status.yml
|
||||
tags:
|
||||
- nginx
|
||||
|
||||
- name: nginx vhost is installed
|
||||
template:
|
||||
src: evolinux-default.conf.j2
|
||||
|
|
37
nginx/tasks/server_status.yml
Normal file
37
nginx/tasks/server_status.yml
Normal file
|
@ -0,0 +1,37 @@
|
|||
---
|
||||
|
||||
- name: server status dirname exists
|
||||
file:
|
||||
dest: "{{ nginx_serverstatus_suffix | dirname }}"
|
||||
mode: "0700"
|
||||
owner: root
|
||||
group: root
|
||||
state: directory
|
||||
|
||||
- name: set nginx serverstatus suffix if provided
|
||||
shell: "echo {{ nginx_serverstatus_suffix }} > {{ nginx_serverstatus_suffix_file }}"
|
||||
when: nginx_serverstatus_suffix != ""
|
||||
|
||||
- name: generate random string for server-status suffix
|
||||
shell: "apg -a 1 -M N -n 1 > {{ nginx_serverstatus_suffix_file }}"
|
||||
args:
|
||||
creates: "{{ nginx_serverstatus_suffix_file }}"
|
||||
|
||||
- name: read nginx server status suffix
|
||||
command: "tail -n 1 {{ nginx_serverstatus_suffix_file }}"
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
register: new_nginx_serverstatus_suffix
|
||||
|
||||
- name: overwrite nginx_serverstatus_suffix
|
||||
set_fact:
|
||||
nginx_serverstatus_suffix: "{{ new_nginx_serverstatus_suffix.stdout }}"
|
||||
|
||||
- debug:
|
||||
var: nginx_serverstatus_suffix
|
||||
|
||||
- name: replace server-status suffix in default site index
|
||||
replace:
|
||||
dest: /var/www/index.html
|
||||
regexp: '__SERVERSTATUS_SUFFIX__'
|
||||
replace: "{{ nginx_serverstatus_suffix }}"
|
|
@ -48,7 +48,7 @@ server {
|
|||
listen 80;
|
||||
server_name munin;
|
||||
|
||||
location /nginx_status {
|
||||
location /nginx_status-{{ nginx_serverstatus_suffix | mandatory }} {
|
||||
stub_status on;
|
||||
access_log off;
|
||||
}
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
rbenv_version: v1.1.1
|
||||
rbenv_ruby_version: 2.4.2
|
||||
rbenv_ruby_version: 2.5.0
|
||||
rbenv_root: "~/.rbenv"
|
||||
rbenv_repo: "https://github.com/rbenv/rbenv.git"
|
||||
rbenv_plugins:
|
||||
|
|
|
@ -31,5 +31,8 @@ redis_maxmemory_samples: 5
|
|||
redis_appendonly: "no"
|
||||
redis_appendfsync: "everysec"
|
||||
|
||||
# Supported only in Redis 3.2+
|
||||
redis_protected_mode: "yes"
|
||||
|
||||
# Add extra include files for local configuration/overrides.
|
||||
redis_includes: []
|
||||
|
|
|
@ -10,6 +10,16 @@
|
|||
- redis
|
||||
- packages
|
||||
|
||||
- name: Get Redis version
|
||||
shell: "redis-server -v | grep -Eo '(v=\\S+)' | cut -d'=' -f 2 | grep -E '^([0-9]|\\.)+$'"
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
register: _redis_installed_version
|
||||
|
||||
- set_fact:
|
||||
redis_installed_version: "{{ _redis_installed_version.stdout }}"
|
||||
check_mode: no
|
||||
|
||||
- name: Redis is configured.
|
||||
template:
|
||||
src: redis.conf.j2
|
||||
|
@ -31,15 +41,27 @@
|
|||
stat:
|
||||
path: /etc/munin/plugins
|
||||
register: _munin_installed
|
||||
tags:
|
||||
- redis
|
||||
- munin
|
||||
|
||||
- include: munin.yml
|
||||
when: _munin_installed.stat.exists and _munin_installed.stat.isdir
|
||||
tags:
|
||||
- redis
|
||||
- munin
|
||||
|
||||
- name: is NRPE present ?
|
||||
stat:
|
||||
path: /etc/nagios/nrpe.d/evolix.cfg
|
||||
check_mode: no
|
||||
register: nrpe_evolix_config
|
||||
tags:
|
||||
- redis
|
||||
- nrpe
|
||||
|
||||
- include: nrpe_stretch.yml
|
||||
when: ansible_distribution_release == "stretch" and nrpe_evolix_config.stat.exists == true
|
||||
tags:
|
||||
- redis
|
||||
- nrpe
|
||||
|
|
|
@ -16,14 +16,16 @@
|
|||
name: /usr/local/share/munin/
|
||||
state: directory
|
||||
mode: "0755"
|
||||
tags: redis
|
||||
tags:
|
||||
- redis
|
||||
|
||||
- name: Create plugin directory
|
||||
file:
|
||||
name: /usr/local/share/munin/plugins/
|
||||
state: directory
|
||||
mode: "0755"
|
||||
tags: redis
|
||||
tags:
|
||||
- redis
|
||||
|
||||
- name: Copy redis munin plugin
|
||||
copy:
|
||||
|
@ -31,7 +33,8 @@
|
|||
dest: /usr/local/share/munin/plugins/redis_
|
||||
mode: "0755"
|
||||
notify: restart munin-node
|
||||
tags: redis
|
||||
tags:
|
||||
- redis
|
||||
|
||||
- name: Enable redis munin plugin
|
||||
file:
|
||||
|
@ -46,7 +49,8 @@
|
|||
- used_keys
|
||||
- used_memory
|
||||
notify: restart munin-node
|
||||
tags: redis
|
||||
tags:
|
||||
- redis
|
||||
|
||||
- name: Count redis condif blocks in munin-node configuration
|
||||
command: grep -c "\[redis_" /etc/munin/plugin-conf.d/munin-node
|
||||
|
|
|
@ -32,6 +32,10 @@ rdbcompression {{ redis_rdbcompression }}
|
|||
dbfilename {{ redis_dbfilename }}
|
||||
dir {{ redis_dbdir }}
|
||||
|
||||
{% if redis_installed_version | version_compare('3.2', '>=') %}
|
||||
protected-mode {{ redis_protected_mode }}
|
||||
{% endif %}
|
||||
|
||||
# maxclients 128
|
||||
|
||||
{% if redis_maxmemory %}
|
||||
|
|
|
@ -6,3 +6,5 @@ puma_max_thread: 4
|
|||
redmine_db_name: "{{ redmine_user }}"
|
||||
redmine_db_host: "localhost"
|
||||
redmine_db_username: "{{ redmine_user }}"
|
||||
redmine_plugins: []
|
||||
redmine_themes: []
|
||||
|
|
|
@ -1 +1,2 @@
|
|||
gem "puma"
|
||||
gem "xpath", "< 3.0.0"
|
||||
|
|
|
@ -211,6 +211,18 @@
|
|||
tags:
|
||||
- redmine
|
||||
|
||||
- name: Install Redmine plugins
|
||||
include: plugins.yml
|
||||
with_items: "{{ redmine_plugins }}"
|
||||
tags:
|
||||
- redmine
|
||||
|
||||
- name: Install Redmine themes
|
||||
include: themes.yml
|
||||
with_items: "{{ redmine_themes }}"
|
||||
tags:
|
||||
- redmine
|
||||
|
||||
- name: Update local gems with bundle
|
||||
bundler:
|
||||
state: present
|
||||
|
@ -218,7 +230,7 @@
|
|||
gem_path: "/home/{{ redmine_user }}/.gems"
|
||||
user_install: yes
|
||||
become_user: "{{ redmine_user }}"
|
||||
when: redmine_git_task.changed or redmine_local_gemfile_task.changed
|
||||
when: redmine_git_task.changed or redmine_local_gemfile_task.changed or redmine_plugin_install.changed
|
||||
|
||||
- name: Migrate database with rake
|
||||
shell: bundle exec rake -qf ~/www/Rakefile db:migrate
|
||||
|
@ -235,6 +247,13 @@
|
|||
become_method: sudo
|
||||
become_flags: '-iu {{ redmine_user }}'
|
||||
|
||||
- name: Migrate plugins
|
||||
shell: bundle exec rake -qf ~/www/Rakefile redmine:plugins:migrate
|
||||
become_user: "{{ redmine_user }}"
|
||||
become_method: sudo
|
||||
become_flags: '-iu {{ redmine_user }}'
|
||||
when: redmine_plugin_install.changed
|
||||
|
||||
- name: Generate secret token
|
||||
shell: bundle exec rake -qf ~/www/Rakefile generate_secret_token
|
||||
args:
|
||||
|
|
28
redmine/tasks/plugins.yml
Normal file
28
redmine/tasks/plugins.yml
Normal file
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
- name: Copy/Update plugin from archive
|
||||
unarchive:
|
||||
src: "{{ item.zip }}"
|
||||
dest: "/home/{{ redmine_user }}/www/plugins/"
|
||||
remote_src: yes
|
||||
owner: "{{ redmine_user }}"
|
||||
group: "{{ redmine_user }}"
|
||||
mode: "0750"
|
||||
register: redmine_plugin_install
|
||||
when: item.zip is defined
|
||||
|
||||
- name: Copy/Update plugin from git repository
|
||||
git:
|
||||
repo: "{{ item.git }}"
|
||||
dest: "/home/{{ redmine_user }}/www/plugins/{{ item.git | basename | splitext | first }}"
|
||||
version: "{{ item.tree | default('master') }}"
|
||||
register: redmine_plugin_install
|
||||
when: item.git is defined
|
||||
|
||||
- name: Fix rights on plugin dir
|
||||
file:
|
||||
path: "/home/{{ redmine_user }}/www/plugins/{{ item.git | basename | splitext | first }}"
|
||||
owner: "{{ redmine_user }}"
|
||||
group: "{{ redmine_user }}"
|
||||
mode: "u=rwX,g=rX,o="
|
||||
recurse: True
|
||||
when: item.git is defined
|
26
redmine/tasks/themes.yml
Normal file
26
redmine/tasks/themes.yml
Normal file
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
- name: Copy/Update theme from archive
|
||||
unarchive:
|
||||
src: "{{ item.zip }}"
|
||||
dest: "/home/{{ redmine_user }}/www/public/themes/"
|
||||
remote_src: yes
|
||||
owner: "{{ redmine_user }}"
|
||||
group: "{{ redmine_user }}"
|
||||
mode: "0750"
|
||||
when: item.zip is defined
|
||||
|
||||
- name: Copy/Update theme from git repository
|
||||
git:
|
||||
repo: "{{ item.git }}"
|
||||
dest: "/home/{{ redmine_user }}/www/public/themes/{{ item.git | basename | splitext | first }}"
|
||||
version: "{{ item.tree | default('master') }}"
|
||||
when: item.git is defined
|
||||
|
||||
- name: Fix rights on theme dir
|
||||
file:
|
||||
path: "/home/{{ redmine_user }}/www/public/themes/{{ item.git | basename | splitext | first }}"
|
||||
owner: "{{ redmine_user }}"
|
||||
group: "{{ redmine_user }}"
|
||||
mode: "0750"
|
||||
recurse: True
|
||||
when: item.git is defined
|
|
@ -1,6 +0,0 @@
|
|||
---
|
||||
- name: logrotate configuration
|
||||
template:
|
||||
src: logrotate.j2
|
||||
dest: /etc/logrotate.d/{{ squid_daemon_name }}
|
||||
force: no
|
29
squid/tasks/logrotate_jessie.yml
Normal file
29
squid/tasks/logrotate_jessie.yml
Normal file
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
|
||||
# md5sum for squid logrotate file :
|
||||
#
|
||||
# --check reads stdin for a list of files and md5 sums
|
||||
# the list contains the checksum for the file provided by Jessie
|
||||
#
|
||||
# We don't use --status so we can debug if needed
|
||||
#
|
||||
# With that command we can check if the logrotate file for squid
|
||||
# is the one provided by the package.
|
||||
|
||||
- name: check if logrotate file is default
|
||||
shell: 'printf "43994674706b672ae5018f592beccf2e /etc/logrotate.d/{{ squid_daemon_name }}" | md5sum --check'
|
||||
changed_when: False
|
||||
failed_when: False
|
||||
check_mode: no
|
||||
register: squid_logrotate_md5
|
||||
tags:
|
||||
- squid
|
||||
|
||||
- name: logrotate configuration
|
||||
template:
|
||||
src: logrotate_jessie.j2
|
||||
dest: /etc/logrotate.d/{{ squid_daemon_name }}
|
||||
force: yes
|
||||
when: squid_logrotate_md5.rc == 0
|
||||
tags:
|
||||
- squid
|
29
squid/tasks/logrotate_stretch.yml
Normal file
29
squid/tasks/logrotate_stretch.yml
Normal file
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
|
||||
# md5sum for squid logrotate file :
|
||||
#
|
||||
# --check reads stdin for a list of files and md5 sums
|
||||
# the list contains the checksum for the file provided by Stretch
|
||||
#
|
||||
# We don't use --status so we can debug if needed
|
||||
#
|
||||
# With that command we can check if the logrotate file for squid
|
||||
# is the one provided by the package.
|
||||
|
||||
- name: check if logrotate file is default
|
||||
shell: 'printf "c210feea019412adac8a5d5dcba427af /etc/logrotate.d/{{ squid_daemon_name }}" | md5sum --check'
|
||||
changed_when: False
|
||||
failed_when: False
|
||||
check_mode: no
|
||||
register: squid_logrotate_md5
|
||||
tags:
|
||||
- squid
|
||||
|
||||
- name: logrotate configuration
|
||||
template:
|
||||
src: logrotate_stretch.j2
|
||||
dest: /etc/logrotate.d/{{ squid_daemon_name }}
|
||||
force: yes
|
||||
when: squid_logrotate_md5.rc == 0
|
||||
tags:
|
||||
- squid
|
|
@ -134,7 +134,11 @@
|
|||
notify: "reload squid"
|
||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||
|
||||
- include: logrotate.yml
|
||||
- include: logrotate_jessie.yml
|
||||
when: ansible_distribution_release == "jessie"
|
||||
|
||||
- include: logrotate_stretch.yml
|
||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||
|
||||
- include: minifirewall.yml
|
||||
|
||||
|
|
|
@ -1,11 +0,0 @@
|
|||
/var/log/{{ squid_daemon_name }}/*.log {
|
||||
monthly
|
||||
compress
|
||||
rotate 12
|
||||
missingok
|
||||
create 640 proxy adm
|
||||
sharedscripts
|
||||
postrotate
|
||||
test ! -e /var/run/{{ squid_daemon_name }}.pid || /usr/sbin/{{ squid_daemon_name }} -k rotate
|
||||
endscript
|
||||
}
|
14
squid/templates/logrotate_jessie.j2
Normal file
14
squid/templates/logrotate_jessie.j2
Normal file
|
@ -0,0 +1,14 @@
|
|||
#
|
||||
# Logrotate fragment for squid3.
|
||||
#
|
||||
/var/log/squid3/*.log {
|
||||
monthly
|
||||
compress
|
||||
rotate 12
|
||||
missingok
|
||||
create 640 proxy adm
|
||||
sharedscripts
|
||||
postrotate
|
||||
test ! -e /var/run/squid3.pid || test ! -x /usr/sbin/squid3 || /usr/sbin/squid3 -k rotate
|
||||
endscript
|
||||
}
|
18
squid/templates/logrotate_stretch.j2
Normal file
18
squid/templates/logrotate_stretch.j2
Normal file
|
@ -0,0 +1,18 @@
|
|||
#
|
||||
# Logrotate fragment for squid.
|
||||
#
|
||||
/var/log/squid/*.log {
|
||||
monthly
|
||||
compress
|
||||
delaycompress
|
||||
rotate 12
|
||||
missingok
|
||||
create 640 proxy adm
|
||||
sharedscripts
|
||||
prerotate
|
||||
test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports monthly
|
||||
endscript
|
||||
postrotate
|
||||
test ! -e /var/run/squid.pid || test ! -x /usr/sbin/squid || /usr/sbin/squid -k rotate
|
||||
endscript
|
||||
}
|
|
@ -7,6 +7,16 @@
|
|||
tags:
|
||||
- unbound
|
||||
|
||||
- name: Retrieve list of root DNS servers
|
||||
get_url:
|
||||
url: https://www.internic.net/domain/named.cache
|
||||
dest: /etc/unbound/root.hints
|
||||
force: yes
|
||||
mode: "0644"
|
||||
notify: reload unbound
|
||||
tags:
|
||||
- unbound
|
||||
|
||||
- name: Copy Unbound config
|
||||
template:
|
||||
src: unbound.conf.j2
|
||||
|
|
|
@ -13,7 +13,7 @@ server:
|
|||
hide-identity: yes
|
||||
hide-version: yes
|
||||
|
||||
# root-hints: "/var/unbound/etc/named.cache"
|
||||
root-hints: "/etc/unbound/root.hints"
|
||||
# Uncomment to enable DNSSEC validation.
|
||||
#auto-trust-anchor-file: "/etc/unbound/root.key"
|
||||
# Serve zones authoritatively from Unbound to resolver clients.
|
||||
|
|
Loading…
Reference in a new issue