From bee57a0b3c23a9d122397d6d5f549d7f374c68a8 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Tue, 18 Jun 2019 17:35:28 +0200 Subject: [PATCH 01/23] change distribution release codename Ansible 2.2 is too old to know about buster. Let's use LSB for that. --- apache/tasks/main.yml | 2 +- apt/tasks/backports.yml | 6 +++--- apt/tasks/basics.yml | 2 +- apt/tasks/evolix_public.yml | 2 +- apt/templates/evolix_public.list.j2 | 2 +- bind/tasks/main.yml | 2 +- elasticsearch/tasks/curator.yml | 2 +- evoacme/tasks/certbot.yml | 2 +- evolinux-base/tasks/hardware.yml | 4 ++-- evolinux-base/tasks/packages.yml | 2 +- evolinux-base/tasks/system.yml | 4 ++-- evolinux-users/tasks/sudo.yml | 2 +- fluentd/tasks/main.yml | 2 +- haproxy/templates/haproxy_apt_preferences.j2 | 2 +- java/tasks/openjdk.yml | 4 ++-- mongodb/tasks/main.yml | 4 ++-- mysql-oracle/tasks/utils.yml | 2 +- mysql/tasks/main.yml | 6 +++--- mysql/tasks/utils.yml | 2 +- nginx/templates/apt/nginx_preferences | 2 +- nodejs/tasks/main.yml | 2 +- packweb-apache/tasks/main.yml | 2 +- percona/tasks/main.yml | 2 +- php/tasks/main.yml | 2 +- postgresql/tasks/main.yml | 2 +- postgresql/tasks/pgdg-repo.yml | 2 +- postgresql/templates/postgresql.pref.j2 | 2 +- redis/tasks/main.yml | 2 +- squid/tasks/main.yml | 8 ++++---- webapps/evoadmin-web/tasks/packages.yml | 2 +- webapps/evoadmin-web/tasks/user.yml | 4 ++-- webapps/evoadmin-web/tasks/web.yml | 2 +- 32 files changed, 44 insertions(+), 44 deletions(-) diff --git a/apache/tasks/main.yml b/apache/tasks/main.yml index a461a8d4..d73f93b2 100644 --- a/apache/tasks/main.yml +++ b/apache/tasks/main.yml @@ -27,7 +27,7 @@ tags: - apache - packages - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: basic modules are enabled apache2_module: diff --git a/apt/tasks/backports.yml b/apt/tasks/backports.yml index 6acf8114..02e189a3 100644 --- a/apt/tasks/backports.yml +++ b/apt/tasks/backports.yml @@ -9,7 +9,7 @@ - name: Backports sources list is installed template: - src: '{{ ansible_distribution_release }}_backports.list.j2' + src: '{{ ansible_lsb.codename }}_backports.list.j2' dest: /etc/apt/sources.list.d/backports.list force: yes mode: "0640" @@ -19,7 +19,7 @@ - name: Backports configuration copy: - src: '{{ ansible_distribution_release }}_backports_preferences' + src: '{{ ansible_lsb.codename }}_backports_preferences' dest: /etc/apt/preferences.d/0-backports-defaults force: yes mode: "0640" @@ -33,7 +33,7 @@ line: 'Acquire::Check-Valid-Until no;' create: yes state: present - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: Apt update apt: diff --git a/apt/tasks/basics.yml b/apt/tasks/basics.yml index f615c030..edd3ea0c 100644 --- a/apt/tasks/basics.yml +++ b/apt/tasks/basics.yml @@ -2,7 +2,7 @@ - name: Change basics repositories template: - src: "{{ ansible_distribution_release }}_basics.list.j2" + src: "{{ ansible_lsb.codename }}_basics.list.j2" dest: /etc/apt/sources.list mode: "0644" force: yes diff --git a/apt/tasks/evolix_public.yml b/apt/tasks/evolix_public.yml index b1db38ab..ba0a0da6 100644 --- a/apt/tasks/evolix_public.yml +++ b/apt/tasks/evolix_public.yml @@ -3,7 +3,7 @@ # - name: Fail if distribution is not supported # fail: # msg: "Error: Evolix public repository is not compatble with 'Debian Stretch' yet." -# when: ansible_distribution_release == "stretch" +# when: ansible_lsb.codename == "stretch" # tags: # - apt diff --git a/apt/templates/evolix_public.list.j2 b/apt/templates/evolix_public.list.j2 index 06de99c0..483d4707 100644 --- a/apt/templates/evolix_public.list.j2 +++ b/apt/templates/evolix_public.list.j2 @@ -1,3 +1,3 @@ # {{ ansible_managed }} -deb http://pub.evolix.net/ {{ ansible_distribution_release }}/ +deb http://pub.evolix.net/ {{ ansible_lsb.codename }}/ diff --git a/bind/tasks/main.yml b/bind/tasks/main.yml index 8fdf1692..9dadc3fb 100644 --- a/bind/tasks/main.yml +++ b/bind/tasks/main.yml @@ -47,7 +47,7 @@ notify: - reload systemd - restart bind - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: touch /var/log/bind.log if non chroot file: diff --git a/elasticsearch/tasks/curator.yml b/elasticsearch/tasks/curator.yml index c7c44259..5b6fdfc8 100644 --- a/elasticsearch/tasks/curator.yml +++ b/elasticsearch/tasks/curator.yml @@ -2,7 +2,7 @@ - name: Use the correct debian repository set_fact: - curator_debian_repository: '{% if ansible_distribution_release == "jessie" %}debian{% else %}debian9{% endif %}' + curator_debian_repository: '{% if ansible_lsb.codename == "jessie" %}debian{% else %}debian9{% endif %}' - name: Curator sources list is available apt_repository: diff --git a/evoacme/tasks/certbot.yml b/evoacme/tasks/certbot.yml index 003c92d0..71825d64 100644 --- a/evoacme/tasks/certbot.yml +++ b/evoacme/tasks/certbot.yml @@ -13,7 +13,7 @@ notify: apt update - meta: flush_handlers - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: Install certbot with apt apt: diff --git a/evolinux-base/tasks/hardware.yml b/evolinux-base/tasks/hardware.yml index 8607a586..cc7e85e5 100644 --- a/evolinux-base/tasks/hardware.yml +++ b/evolinux-base/tasks/hardware.yml @@ -57,13 +57,13 @@ apt_key: # url: https://hwraid.le-vert.net/debian/hwraid.le-vert.net.gpg.key data: "{{ lookup('file', 'hwraid.le-vert.net.gpg.key') }}" - when: ansible_distribution_release == "stretch" + when: ansible_lsb.codename == "stretch" - name: Add HW tool repository apt_repository: repo: 'deb http://hwraid.le-vert.net/debian stretch main' state: present - when: ansible_distribution_release == "stretch" + when: ansible_lsb.codename == "stretch" - name: Install packages for DELL/LSI hardware apt: diff --git a/evolinux-base/tasks/packages.yml b/evolinux-base/tasks/packages.yml index aab2f6da..f24aaef9 100644 --- a/evolinux-base/tasks/packages.yml +++ b/evolinux-base/tasks/packages.yml @@ -126,7 +126,7 @@ when: - evolinux_packages_listchanges - ansible_distribution == "Debian" - - ansible_distribution_release == "jessie" + - ansible_lsb.codename == "jessie" - name: apt-listchanges is absent on Stretch and later apt: diff --git a/evolinux-base/tasks/system.yml b/evolinux-base/tasks/system.yml index 4ef08fa3..502df7e9 100644 --- a/evolinux-base/tasks/system.yml +++ b/evolinux-base/tasks/system.yml @@ -125,7 +125,7 @@ mode: "0755" when: - evolinux_system_alert5_init - - ansible_distribution_release == "jessie" or ansible_distribution_release == "stretch" + - ansible_lsb.codename == "jessie" or ansible_lsb.codename == "stretch" - name: Enable alert5 init script (jessie/stretch) service: @@ -134,7 +134,7 @@ when: - evolinux_system_alert5_init - evolinux_system_alert5_enable - - ansible_distribution_release == "jessie" or ansible_distribution_release == "stretch" + - ansible_lsb.codename == "jessie" or ansible_lsb.codename == "stretch" diff --git a/evolinux-users/tasks/sudo.yml b/evolinux-users/tasks/sudo.yml index ed696b43..a4b28d25 100644 --- a/evolinux-users/tasks/sudo.yml +++ b/evolinux-users/tasks/sudo.yml @@ -1,7 +1,7 @@ --- - include: sudo_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: sudo_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/fluentd/tasks/main.yml b/fluentd/tasks/main.yml index 118b78b0..cad4f17e 100644 --- a/fluentd/tasks/main.yml +++ b/fluentd/tasks/main.yml @@ -9,7 +9,7 @@ - name: Fluentd sources list is available apt_repository: - repo: "deb http://packages.treasuredata.com/3/debian/{{ ansible_distribution_release }}/ {{ ansible_distribution_release }} contrib" + repo: "deb http://packages.treasuredata.com/3/debian/{{ ansible_lsb.codename }}/ {{ ansible_lsb.codename }} contrib" filename: treasuredata update_cache: yes state: present diff --git a/haproxy/templates/haproxy_apt_preferences.j2 b/haproxy/templates/haproxy_apt_preferences.j2 index 706ee67d..144f1bc2 100644 --- a/haproxy/templates/haproxy_apt_preferences.j2 +++ b/haproxy/templates/haproxy_apt_preferences.j2 @@ -1,3 +1,3 @@ Package: haproxy libssl1.0.0 -Pin: release a={{ ansible_distribution_release }}-backports +Pin: release a={{ ansible_lsb.codename }}-backports Pin-Priority: 999 diff --git a/java/tasks/openjdk.yml b/java/tasks/openjdk.yml index 9b4f0b7d..20e1f04c 100644 --- a/java/tasks/openjdk.yml +++ b/java/tasks/openjdk.yml @@ -1,7 +1,7 @@ --- - name: Decide which Debian release to use set_fact: - java_apt_release: '{% if ansible_distribution_release == "jessie" %}jessie-backports{% else %}{{ ansible_distribution_release }}{% endif %}' + java_apt_release: '{% if ansible_lsb.codename == "jessie" %}jessie-backports{% else %}{{ ansible_lsb.codename }}{% endif %}' tags: - java @@ -9,7 +9,7 @@ include_role: name: apt tasks_from: backports.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" tags: - java diff --git a/mongodb/tasks/main.yml b/mongodb/tasks/main.yml index a13183c6..e97ed3a8 100644 --- a/mongodb/tasks/main.yml +++ b/mongodb/tasks/main.yml @@ -3,10 +3,10 @@ # - fail: # msg: only compatible with Debian 8 # when: -# - ansible_distribution != "Debian" or ansible_distribution_release != "jessie" +# - ansible_distribution != "Debian" or ansible_lsb.codename != "jessie" - include: main_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: main_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/mysql-oracle/tasks/utils.yml b/mysql-oracle/tasks/utils.yml index 79587f16..cc2c6233 100644 --- a/mysql-oracle/tasks/utils.yml +++ b/mysql-oracle/tasks/utils.yml @@ -22,7 +22,7 @@ - packages - mytop - mysql - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" # - name: "mysql-utilities are installed (Debian 9 or later)" # apt: diff --git a/mysql/tasks/main.yml b/mysql/tasks/main.yml index 8e14c8de..ff47c6ac 100644 --- a/mysql/tasks/main.yml +++ b/mysql/tasks/main.yml @@ -7,19 +7,19 @@ when: ansible_distribution_major_version | version_compare('9', '>=') - include: packages_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: users_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') - include: users_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: config_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') - include: config_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: datadir.yml diff --git a/mysql/tasks/utils.yml b/mysql/tasks/utils.yml index 390acc0e..74ebceef 100644 --- a/mysql/tasks/utils.yml +++ b/mysql/tasks/utils.yml @@ -22,7 +22,7 @@ - packages - mytop - mysql - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "Install depends for mytop (Debian 9 or later)" apt: diff --git a/nginx/templates/apt/nginx_preferences b/nginx/templates/apt/nginx_preferences index 84bf65ff..c0fb042a 100644 --- a/nginx/templates/apt/nginx_preferences +++ b/nginx/templates/apt/nginx_preferences @@ -1,3 +1,3 @@ Package: nginx nginx-* libnginx-* libssl* -Pin: release a={{ ansible_distribution_release }}-backports +Pin: release a={{ ansible_lsb.codename }}-backports Pin-Priority: 999 diff --git a/nodejs/tasks/main.yml b/nodejs/tasks/main.yml index bad66d95..d0754d52 100644 --- a/nodejs/tasks/main.yml +++ b/nodejs/tasks/main.yml @@ -19,7 +19,7 @@ - name: NodeJS sources list ({{ nodejs_apt_version }}) is available apt_repository: - repo: "deb https://deb.nodesource.com/{{ nodejs_apt_version }} {{ ansible_distribution_release }} main" + repo: "deb https://deb.nodesource.com/{{ nodejs_apt_version }} {{ ansible_lsb.codename }} main" filename: nodesource update_cache: yes state: present diff --git a/packweb-apache/tasks/main.yml b/packweb-apache/tasks/main.yml index f5d0f35e..71e479d6 100644 --- a/packweb-apache/tasks/main.yml +++ b/packweb-apache/tasks/main.yml @@ -48,7 +48,7 @@ src: userlogrotate_jessie dest: /etc/cron.weekly/userlogrotate mode: "0755" - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "Install userlogrotate (Debian 9 or later)" copy: diff --git a/percona/tasks/main.yml b/percona/tasks/main.yml index cce78c3a..701bba47 100644 --- a/percona/tasks/main.yml +++ b/percona/tasks/main.yml @@ -1,7 +1,7 @@ --- - set_fact: - percona__apt_config_package_file: "percona-release_latest.{{ ansible_distribution_release }}_all.deb" + percona__apt_config_package_file: "percona-release_latest.{{ ansible_lsb.codename }}_all.deb" - name: Add Percona's official GPG key apt_key: diff --git a/php/tasks/main.yml b/php/tasks/main.yml index 38ece76b..6e45babf 100644 --- a/php/tasks/main.yml +++ b/php/tasks/main.yml @@ -6,7 +6,7 @@ - ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<') - include: main_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: main_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/postgresql/tasks/main.yml b/postgresql/tasks/main.yml index 3bc1f904..17917abe 100644 --- a/postgresql/tasks/main.yml +++ b/postgresql/tasks/main.yml @@ -1,7 +1,7 @@ --- - include: packages_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: packages_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/postgresql/tasks/pgdg-repo.yml b/postgresql/tasks/pgdg-repo.yml index dcc63d6f..4019aded 100644 --- a/postgresql/tasks/pgdg-repo.yml +++ b/postgresql/tasks/pgdg-repo.yml @@ -10,7 +10,7 @@ - name: Add PGDG repository apt_repository: - repo: "deb http://apt.postgresql.org/pub/repos/apt/ {{ansible_distribution_release}}-pgdg main" + repo: "deb http://apt.postgresql.org/pub/repos/apt/ {{ansible_lsb.codename}}-pgdg main" update_cache: yes - name: Add GPG key for PGDG repository diff --git a/postgresql/templates/postgresql.pref.j2 b/postgresql/templates/postgresql.pref.j2 index 74196cf6..608c4dd6 100644 --- a/postgresql/templates/postgresql.pref.j2 +++ b/postgresql/templates/postgresql.pref.j2 @@ -1,3 +1,3 @@ Package: postgresql-{{postgresql_version}} postgresql-client-common postgresql-common libpq5 ptop -Pin: release a={{ansible_distribution_release}}-pgdg +Pin: release a={{ansible_lsb.codename}}-pgdg Pin-Priority: 999 diff --git a/redis/tasks/main.yml b/redis/tasks/main.yml index b0dce043..e75ec8f9 100644 --- a/redis/tasks/main.yml +++ b/redis/tasks/main.yml @@ -93,7 +93,7 @@ - nrpe - include: nrpe_stretch.yml - when: ansible_distribution_release == "stretch" and nrpe_evolix_config.stat.exists == true + when: ansible_lsb.codename == "stretch" and nrpe_evolix_config.stat.exists == true tags: - redis - nrpe diff --git a/squid/tasks/main.yml b/squid/tasks/main.yml index 17429954..5dddf87b 100644 --- a/squid/tasks/main.yml +++ b/squid/tasks/main.yml @@ -8,7 +8,7 @@ - name: "Set squid name (jessie)" set_fact: squid_daemon_name: squid3 - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "Set squid name (Debian 9 or later)" set_fact: @@ -34,7 +34,7 @@ src: squid.conf.j2 dest: /etc/squid3/squid.conf notify: "restart squid3" - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "evolix whitelist is present (jessie)" copy: @@ -42,7 +42,7 @@ dest: /etc/squid3/whitelist.conf force: no notify: "reload squid3" - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "evolinux defaults squid file (Debian 9 or later)" copy: @@ -135,7 +135,7 @@ when: ansible_distribution_major_version | version_compare('9', '>=') - include: logrotate_jessie.yml - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - include: logrotate_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/webapps/evoadmin-web/tasks/packages.yml b/webapps/evoadmin-web/tasks/packages.yml index 79d1e312..45d7e72e 100644 --- a/webapps/evoadmin-web/tasks/packages.yml +++ b/webapps/evoadmin-web/tasks/packages.yml @@ -19,4 +19,4 @@ allow_unauthenticated: yes with_items: - php5-pam - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" diff --git a/webapps/evoadmin-web/tasks/user.yml b/webapps/evoadmin-web/tasks/user.yml index 460dc28e..7dc18a25 100644 --- a/webapps/evoadmin-web/tasks/user.yml +++ b/webapps/evoadmin-web/tasks/user.yml @@ -17,7 +17,7 @@ name: www-evoadmin groups: shadow append: yes - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "Create www-evoadmin (Debian 9 or later)" user: @@ -52,7 +52,7 @@ dest: "{{ evoadmin_document_root }}" version: jessie update: no - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "Clone evoadmin repository (Debian 9 or later)" git: diff --git a/webapps/evoadmin-web/tasks/web.yml b/webapps/evoadmin-web/tasks/web.yml index d8405f8f..23b35204 100644 --- a/webapps/evoadmin-web/tasks/web.yml +++ b/webapps/evoadmin-web/tasks/web.yml @@ -7,7 +7,7 @@ option: "disable_functions" value: "shell-exec,system,passthru,putenv,popen" notify: reload apache2 - when: ansible_distribution_release == "jessie" + when: ansible_lsb.codename == "jessie" - name: "Set custom values for PHP config (Debian 9 or later)" ini_file: From b362f422dfe5f396adfb8ca186d52aec507395aa Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Wed, 19 Jun 2019 15:08:54 +0200 Subject: [PATCH 02/23] evolinux-base: packages for Buster and later --- evolinux-base/defaults/main.yml | 1 + evolinux-base/tasks/packages.yml | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/evolinux-base/defaults/main.yml b/evolinux-base/defaults/main.yml index 88ea931d..d4dc13d7 100644 --- a/evolinux-base/defaults/main.yml +++ b/evolinux-base/defaults/main.yml @@ -77,6 +77,7 @@ evolinux_packages_diagnostic: True evolinux_packages_hardware: True evolinux_packages_common: True evolinux_packages_stretch: True +evolinux_packages_buster: True evolinux_packages_serveur_base: True evolinux_packages_purge_openntpd: True evolinux_packages_purge_locate: True diff --git a/evolinux-base/tasks/packages.yml b/evolinux-base/tasks/packages.yml index f24aaef9..b4d9cee1 100644 --- a/evolinux-base/tasks/packages.yml +++ b/evolinux-base/tasks/packages.yml @@ -91,11 +91,19 @@ name: "{{ item }}" with_items: - net-tools - - spectre-meltdown-checker when: - evolinux_packages_stretch - ansible_distribution_major_version | version_compare('9', '>=') +- name: Install/Update packages for Buster and later + apt: + name: "{{ item }}" + with_items: + - spectre-meltdown-checker + when: + - evolinux_packages_buster + - ansible_distribution_major_version | version_compare('10', '>=') + - name: Customize logcheck recipient lineinfile: dest: /etc/logcheck/logcheck.conf From b83574592f0849a3e741e844de3e3a32d409eb37 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Wed, 19 Jun 2019 15:13:25 +0200 Subject: [PATCH 03/23] evolinux-base: install "spectre-meltdown-checker" (Debian 10 and later) --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index adfc4355..98a91bd9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,7 +14,7 @@ The **patch** part changes incrementally at each release. * apache: add server status suffix in VHost (and default site) if missing * apt: add a script to manage packages with "hold" mark * etc-git: gitignore /etc/letsencrypt/.certbot.lock -* evolinux-base: install "spectre-meltdown-checker" (Debian 9 and later) +* evolinux-base: install "spectre-meltdown-checker" (Debian 10 and later) * evomaintenance: make hooks configurable * nginx: add server status suffix in VHost (and default site) if missing * redmine: enable gzip compression in nginx vhost From 77246710b669fb965d6797377167d0d726f7855e Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Thu, 20 Jun 2019 17:38:37 +0200 Subject: [PATCH 04/23] utilisation du lsb.codename --- docker-host/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-host/tasks/main.yml b/docker-host/tasks/main.yml index c15fc761..86d10437 100644 --- a/docker-host/tasks/main.yml +++ b/docker-host/tasks/main.yml @@ -21,13 +21,13 @@ - name: Add Docker repository apt_repository: - repo: 'deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable' + repo: 'deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_lsb.codename }} stable' state: present update_cache: no filename: docker.list - include: jessie_backports.yml - when: ansible_distribution_release == 'jessie' + when: ansible_lsb.codename == 'jessie' - name: Add Docker's official GPG key apt_key: From fecdbb0406e51fefef2159f23cb90ea26a7dac8d Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Mon, 24 Jun 2019 17:08:01 +0200 Subject: [PATCH 05/23] evolinux-base: use the variable for the "ssh" group name --- evolinux-base/tasks/ssh.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/evolinux-base/tasks/ssh.yml b/evolinux-base/tasks/ssh.yml index c6b87cae..2dab992b 100644 --- a/evolinux-base/tasks/ssh.yml +++ b/evolinux-base/tasks/ssh.yml @@ -11,7 +11,7 @@ # only the first instance of the keyword is applied. » # # We want to allow any user from a list of IP addresses to login with password, -# but users of the "evolix" group can't login with password from other IP addresses +# but users of the "{{ evolinux_ssh_group }}" group can't login with password from other IP addresses - name: "Security directives for Evolinux (Debian 10 or later)" blockinfile: @@ -20,7 +20,7 @@ block: | Match Address {{ evolinux_ssh_password_auth_addresses | join(',') }} PasswordAuthentication yes - Match Group evolix + Match Group {{ evolinux_ssh_group }} PasswordAuthentication no insertafter: EOF validate: '/usr/sbin/sshd -t -f %s' From bb6191d10493d202f8fd04341deda3605060ff58 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Mon, 24 Jun 2019 17:08:33 +0200 Subject: [PATCH 06/23] apt: the the public source list for Stretch until it's ready for Buster --- apt/templates/evolix_public.list.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apt/templates/evolix_public.list.j2 b/apt/templates/evolix_public.list.j2 index 483d4707..952588d0 100644 --- a/apt/templates/evolix_public.list.j2 +++ b/apt/templates/evolix_public.list.j2 @@ -1,3 +1,4 @@ # {{ ansible_managed }} -deb http://pub.evolix.net/ {{ ansible_lsb.codename }}/ +# deb http://pub.evolix.net/ {{ ansible_lsb.codename }}/ +deb http://pub.evolix.net/ stretch/ From a4236a0708aa713a6bd595bcd66df60d469f3a58 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Wed, 26 Jun 2019 17:39:22 +0200 Subject: [PATCH 07/23] php: look for PHP 7.3 with buster --- php/tasks/main.yml | 3 ++ php/tasks/main_buster.yml | 95 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 98 insertions(+) create mode 100644 php/tasks/main_buster.yml diff --git a/php/tasks/main.yml b/php/tasks/main.yml index 6e45babf..41b93b27 100644 --- a/php/tasks/main.yml +++ b/php/tasks/main.yml @@ -9,4 +9,7 @@ when: ansible_lsb.codename == "jessie" - include: main_stretch.yml + when: ansible_lsb.codename == "stretch" + +- include: main_buster.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/php/tasks/main_buster.yml b/php/tasks/main_buster.yml new file mode 100644 index 00000000..8556a503 --- /dev/null +++ b/php/tasks/main_buster.yml @@ -0,0 +1,95 @@ +--- + +- name: "Set variables (Debian 10 or later)" + set_fact: + php_cli_defaults_ini_file: /etc/php/7.3/cli/conf.d/z-evolinux-defaults.ini + php_cli_custom_ini_file: /etc/php/7.3/cli/conf.d/zzz-evolinux-custom.ini + php_apache_defaults_ini_file: /etc/php/7.3/apache2/conf.d/z-evolinux-defaults.ini + php_apache_custom_ini_file: /etc/php/7.3/apache2/conf.d/zzz-evolinux-custom.ini + php_fpm_defaults_ini_file: /etc/php/7.3/fpm/conf.d/z-evolinux-defaults.ini + php_fpm_custom_ini_file: /etc/php/7.3/fpm/conf.d/zzz-evolinux-custom.ini + php_fpm_defaults_conf_file: /etc/php/7.3/fpm/pool.d/z-evolinux-defaults.conf + php_fpm_custom_conf_file: /etc/php/7.3/fpm/pool.d/zzz-evolinux-custom.conf + php_fpm_service_name: php7.3-fpm + +# Packages + +- name: "Set package list (Debian 9 or later)" + set_fact: + php_stretch_packages: + - php-cli + - php-gd + - php-intl + - php-imap + - php-ldap + - php-mysql + # php-mcrypt is no longer packaged for PHP 7.2 + - php-pgsql + - php-gettext + - php-curl + - php-ssh2 + - php-zip + - composer + - libphp-phpmailer + +- include: sury_pre.yml + when: php_sury_enable + +- name: "Install PHP packages (Debian 9 or later)" + apt: + name: '{{ item }}' + state: present + with_items: "{{ php_stretch_packages }}" + +- name: "Install mod_php packages (Debian 9 or later)" + apt: + name: '{{ item }}' + state: present + with_items: + - libapache2-mod-php + - php + when: php_apache_enable + +- name: "Install PHP FPM packages (Debian 9 or later)" + apt: + name: '{{ item }}' + state: present + with_items: + - php-fpm + - php + when: php_fpm_enable + +# Configuration + +- name: Enforce permissions on PHP directory + file: + dest: "{{ item }}" + mode: "0755" + with_items: + - /etc/php + - /etc/php/7.3 + +- include: config_cli.yml +- name: Enforce permissions on PHP cli directory + file: + dest: /etc/php/7.3/cli + mode: "0755" + +- include: config_fpm.yml + when: php_fpm_enable +- name: Enforce permissions on PHP fpm directory + file: + dest: /etc/php/7.3/fpm + mode: "0755" + when: php_fpm_enable + +- include: config_apache.yml + when: php_apache_enable +- name: Enforce permissions on PHP apache2 directory + file: + dest: /etc/php/7.3/apache2 + mode: "0755" + when: php_apache_enable + +- include: sury_post.yml + when: php_sury_enable From c147a4674d9d604356aee709760b4e3c91fc7311 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Wed, 26 Jun 2019 17:46:36 +0200 Subject: [PATCH 08/23] mysql : mytop dependencies for buster --- mysql/tasks/utils.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/mysql/tasks/utils.yml b/mysql/tasks/utils.yml index 74ebceef..c2fbb735 100644 --- a/mysql/tasks/utils.yml +++ b/mysql/tasks/utils.yml @@ -24,14 +24,23 @@ - mysql when: ansible_lsb.codename == "jessie" -- name: "Install depends for mytop (Debian 9 or later)" +- name: "Install depends for mytop (stretch)" apt: name: "{{ item }}" with_items: - mariadb-client-10.1 - libconfig-inifiles-perl - libterm-readkey-perl - when: ansible_distribution_major_version | version_compare('9', '>=') + when: ansible_lsb.codename == "stretch" + +- name: "Install depends for mytop (Debian 10 or later)" + apt: + name: "{{ item }}" + with_items: + - mariadb-client-10.3 + - libconfig-inifiles-perl + - libterm-readkey-perl + when: ansible_distribution_major_version | version_compare('10', '>=') - name: Read debian-sys-maint password shell: 'cat /etc/mysql/debian.cnf | grep -m1 "password = .*" | cut -d" " -f3' From b773e17560d379082334b19135ec5aa78875a665 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Thu, 27 Jun 2019 16:16:19 +0200 Subject: [PATCH 09/23] whitespaces --- packweb-apache/tasks/apache.yml | 19 ++++--- packweb-apache/tasks/fhs_retrictions.yml | 67 ++++++++++++------------ packweb-apache/tasks/main.yml | 2 +- packweb-apache/tasks/phpmyadmin.yml | 4 +- webapps/evoadmin-web/tasks/packages.yml | 19 +++++-- 5 files changed, 59 insertions(+), 52 deletions(-) diff --git a/packweb-apache/tasks/apache.yml b/packweb-apache/tasks/apache.yml index 31570944..750875bb 100644 --- a/packweb-apache/tasks/apache.yml +++ b/packweb-apache/tasks/apache.yml @@ -21,19 +21,19 @@ name: '{{ item }}' state: present with_items: - - libapache2-mod-security2 - - modsecurity-crs - - apg + - libapache2-mod-security2 + - modsecurity-crs + - apg - name: Additional modules are enabled apache2_module: name: '{{ item }}' state: present with_items: - - ssl - - include - - negotiation - - alias + - ssl + - include + - negotiation + - alias - name: Copy Apache settings for modules copy: @@ -58,6 +58,5 @@ register: command_result changed_when: "'Enabling' in command_result.stderr" with_items: - - evolinux-evasive - - evolinux-modsec - + - evolinux-evasive + - evolinux-modsec diff --git a/packweb-apache/tasks/fhs_retrictions.yml b/packweb-apache/tasks/fhs_retrictions.yml index 2308db2a..09dd4b78 100644 --- a/packweb-apache/tasks/fhs_retrictions.yml +++ b/packweb-apache/tasks/fhs_retrictions.yml @@ -6,23 +6,23 @@ changed_when: "'changed' in command_result.stdout" failed_when: False with_items: - - / - - /etc - - /usr - - /usr/bin - - /var - - /var/log - - /home - - /bin - - /sbin - - /lib - - /usr/lib - - /usr/include - - /usr/bin - - /usr/sbin - - /usr/share - - /usr/share/doc - - /etc/default + - / + - /etc + - /usr + - /usr/bin + - /var + - /var/log + - /home + - /bin + - /sbin + - /lib + - /usr/lib + - /usr/include + - /usr/bin + - /usr/sbin + - /usr/share + - /usr/share/doc + - /etc/default - name: Set 750 permission on some folders (/var/log/apt, /var/log/munin, ...) shell: "test -d {{ item }} && chmod --verbose 750 {{ item }}" @@ -30,15 +30,15 @@ changed_when: "'changed' in command_result.stdout" failed_when: False with_items: - - /var/log/apt - - /var/lib/dpkg - - /var/log/munin - - /var/backups - - /etc/init.d - - /etc/apache2 - - /etc/network - - /etc/phpmyadmin - - /var/log/installer + - /var/log/apt + - /var/lib/dpkg + - /var/log/munin + - /var/backups + - /etc/init.d + - /etc/apache2 + - /etc/network + - /etc/phpmyadmin + - /var/log/installer - name: Change group to www-data for /etc/phpmyadmin/ file: @@ -51,11 +51,11 @@ changed_when: "'changed' in command_result.stdout" failed_when: False with_items: - - /bin/ping - - /bin/ping6 - - /usr/bin/fping - - /usr/bin/fping6 - - /usr/bin/mtr + - /bin/ping + - /bin/ping6 + - /usr/bin/fping + - /usr/bin/fping6 + - /usr/bin/mtr - name: Set 640 permission on some files (/var/log/evolix.log, ...) shell: "test -f {{ item }} && chmod --verbose 640 {{ item }}" @@ -63,6 +63,5 @@ changed_when: "'changed' in command_result.stdout" failed_when: False with_items: - - /var/log/evolix.log - - /etc/warnquota.conf - + - /var/log/evolix.log + - /etc/warnquota.conf diff --git a/packweb-apache/tasks/main.yml b/packweb-apache/tasks/main.yml index 71e479d6..64d60ded 100644 --- a/packweb-apache/tasks/main.yml +++ b/packweb-apache/tasks/main.yml @@ -65,7 +65,7 @@ - include: apache.yml -- include: phpmyadmin.yml +# - include: phpmyadmin.yml - include: awstats.yml diff --git a/packweb-apache/tasks/phpmyadmin.yml b/packweb-apache/tasks/phpmyadmin.yml index eac50843..5f56a162 100644 --- a/packweb-apache/tasks/phpmyadmin.yml +++ b/packweb-apache/tasks/phpmyadmin.yml @@ -5,8 +5,8 @@ name: '{{ item }}' state: present with_items: - - phpmyadmin - - apg + - phpmyadmin + - apg - name: Check if phpmyadmin default configuration is present stat: diff --git a/webapps/evoadmin-web/tasks/packages.yml b/webapps/evoadmin-web/tasks/packages.yml index 45d7e72e..4dcdd882 100644 --- a/webapps/evoadmin-web/tasks/packages.yml +++ b/webapps/evoadmin-web/tasks/packages.yml @@ -4,19 +4,28 @@ name: apt tasks_from: evolix_public.yml -- name: Install PHP packages +- name: Install PHP packages (Debian 10 and later) apt: name: '{{ item }}' state: present with_items: - - php-pear - - php-log + - php-pear + when: ansible_distribution_major_version | version_compare('10', '>=') -- name: Install PHP5 packages +- name: Install PHP packages (stretch) + apt: + name: '{{ item }}' + state: present + with_items: + - php-pear + - php-log + when: ansible_lsb.codename == "stretch" + +- name: Install PHP5 packages (jessie) apt: name: '{{ item }}' state: present allow_unauthenticated: yes with_items: - - php5-pam + - php5-pam when: ansible_lsb.codename == "jessie" From 2b9354b5491ce40c6a7508855f217c05e9b7d3e2 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Thu, 27 Jun 2019 16:19:17 +0200 Subject: [PATCH 10/23] re-enable phpmyadmin --- packweb-apache/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packweb-apache/tasks/main.yml b/packweb-apache/tasks/main.yml index 64d60ded..71e479d6 100644 --- a/packweb-apache/tasks/main.yml +++ b/packweb-apache/tasks/main.yml @@ -65,7 +65,7 @@ - include: apache.yml -# - include: phpmyadmin.yml +- include: phpmyadmin.yml - include: awstats.yml From 5199a384c39051108aaf2006ce544afd945bb18a Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Thu, 27 Jun 2019 16:33:11 +0200 Subject: [PATCH 11/23] packweb-apache : create phpmyadmin directory if missing --- packweb-apache/tasks/fhs_retrictions.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/packweb-apache/tasks/fhs_retrictions.yml b/packweb-apache/tasks/fhs_retrictions.yml index 09dd4b78..1d370038 100644 --- a/packweb-apache/tasks/fhs_retrictions.yml +++ b/packweb-apache/tasks/fhs_retrictions.yml @@ -44,6 +44,7 @@ file: dest: /etc/phpmyadmin/ group: www-data + state: directory - name: Set u-s permission on some binaries (/bin/ping, /usr/bin/mtr, ...) shell: "test -f {{ item }} && chmod --verbose u-s {{ item }}" From 2e83fc00ccbc44e1670042bc3535c273fd64ca58 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Thu, 27 Jun 2019 16:34:01 +0200 Subject: [PATCH 12/23] whitespaces --- spamassasin/tasks/main.yml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/spamassasin/tasks/main.yml b/spamassasin/tasks/main.yml index 3d2efe0f..3353e882 100644 --- a/spamassasin/tasks/main.yml +++ b/spamassasin/tasks/main.yml @@ -4,10 +4,10 @@ name: "{{ item }}" state: present with_items: - - spamassassin - - evomaintenance + - spamassassin + - evomaintenance tags: - - spamassassin + - spamassassin - name: configure SpamAssasin copy: @@ -16,7 +16,7 @@ mode: "0644" notify: restart spamassassin tags: - - spamassassin + - spamassassin - name: enable SpamAssasin replace: @@ -25,7 +25,7 @@ replace: 'ENABLED=1' notify: restart spamassassin tags: - - spamassassin + - spamassassin - name: add amavis user to debian-spamd group user: @@ -33,7 +33,7 @@ groups: debian-spamd append: yes tags: - - spamassassin + - spamassassin - name: fix right on /var/lib/spamassassin file: @@ -41,12 +41,12 @@ state: directory mode: "0750" tags: - - spamassassin + - spamassassin - include_role: name: remount-usr tags: - - spamassassin + - spamassassin - name: copy sa-update.sh script copy: @@ -54,7 +54,7 @@ dest: /usr/share/scripts/sa-update.sh mode: "0750" tags: - - spamassassin + - spamassassin - name: enable sa-update.sh cron lineinfile: @@ -64,13 +64,13 @@ state: present mode: "0640" tags: - - spamassassin + - spamassassin - name: update SpamAssasin's rules command: "/usr/share/scripts/sa-update.sh" changed_when: false tags: - - spamassassin + - spamassassin - name: ensure SpamAssasin is started and enabled systemd: @@ -78,4 +78,4 @@ state: started enabled: True tags: - - spamassassin + - spamassassin From 0b8681cf596cf6f906f6f136706d0cdf1bce6f6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= Date: Wed, 3 Jul 2019 09:37:57 +0200 Subject: [PATCH 13/23] packweb-apache: install phpmyadmin using .deb for Buster Fixes #64 /!\ Warning: this is a temporary hack! --- packweb-apache/tasks/phpmyadmin.yml | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/packweb-apache/tasks/phpmyadmin.yml b/packweb-apache/tasks/phpmyadmin.yml index 5f56a162..dfc5e1a9 100644 --- a/packweb-apache/tasks/phpmyadmin.yml +++ b/packweb-apache/tasks/phpmyadmin.yml @@ -1,12 +1,23 @@ --- -- name: Install phpmyadmin +- name: Install apg apt: - name: '{{ item }}' - state: present - with_items: - - phpmyadmin - - apg + name: apg + +- name: Install phpmyadmin (Debian <=9) + apt: + name: phpmyadmin + when: ansible_distribution_major_version | version_compare('9', '<=') + +- include_role: + name: remount-usr + +# /!\ Warning: this is a temporary hack as phpmyadmin for Buster is not yet +# available +- name: Install phpmyadmin using sid package (Debian >=10) + apt: + deb: http://mirror.evolix.org/debian/pool/main/p/phpmyadmin/phpmyadmin_4.6.6-5_all.deb + when: ansible_distribution_major_version | version_compare('10', '>=') - name: Check if phpmyadmin default configuration is present stat: From 771c75c1dee4365b98d7312a1147d0ffa423e0ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= Date: Wed, 3 Jul 2019 09:41:35 +0200 Subject: [PATCH 14/23] all-roles: Dot not use ansible_lsb as it is deprecated We move from `ansible_lsb.codename` to `ansible_distribution_release`. --- apache/tasks/main.yml | 2 +- apt/tasks/backports.yml | 6 +++--- apt/tasks/basics.yml | 2 +- apt/tasks/evolix_public.yml | 2 +- apt/templates/evolix_public.list.j2 | 2 +- bind/tasks/main.yml | 2 +- docker-host/tasks/main.yml | 4 ++-- elasticsearch/tasks/curator.yml | 2 +- evoacme/tasks/certbot.yml | 2 +- evolinux-base/tasks/hardware.yml | 4 ++-- evolinux-base/tasks/packages.yml | 2 +- evolinux-base/tasks/system.yml | 4 ++-- evolinux-users/tasks/sudo.yml | 2 +- fluentd/tasks/main.yml | 2 +- haproxy/templates/haproxy_apt_preferences.j2 | 2 +- java/tasks/openjdk.yml | 4 ++-- mongodb/tasks/main.yml | 4 ++-- mysql-oracle/tasks/utils.yml | 2 +- mysql/tasks/main.yml | 6 +++--- mysql/tasks/utils.yml | 4 ++-- nginx/templates/apt/nginx_preferences | 2 +- nodejs/tasks/main.yml | 2 +- packweb-apache/tasks/main.yml | 2 +- percona/tasks/main.yml | 2 +- php/tasks/main.yml | 4 ++-- postgresql/tasks/main.yml | 2 +- postgresql/tasks/pgdg-repo.yml | 2 +- postgresql/templates/postgresql.pref.j2 | 2 +- redis/tasks/main.yml | 2 +- squid/tasks/main.yml | 8 ++++---- webapps/evoadmin-web/tasks/packages.yml | 4 ++-- webapps/evoadmin-web/tasks/user.yml | 4 ++-- webapps/evoadmin-web/tasks/web.yml | 2 +- 33 files changed, 49 insertions(+), 49 deletions(-) diff --git a/apache/tasks/main.yml b/apache/tasks/main.yml index d73f93b2..a461a8d4 100644 --- a/apache/tasks/main.yml +++ b/apache/tasks/main.yml @@ -27,7 +27,7 @@ tags: - apache - packages - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: basic modules are enabled apache2_module: diff --git a/apt/tasks/backports.yml b/apt/tasks/backports.yml index 0bdc82c7..3f95300c 100644 --- a/apt/tasks/backports.yml +++ b/apt/tasks/backports.yml @@ -9,7 +9,7 @@ - name: Backports sources list is installed template: - src: '{{ ansible_lsb.codename }}_backports.list.j2' + src: '{{ ansible_distribution_release }}_backports.list.j2' dest: /etc/apt/sources.list.d/backports.list force: yes mode: "0640" @@ -19,7 +19,7 @@ - name: Backports configuration copy: - src: '{{ ansible_lsb.codename }}_backports_preferences' + src: '{{ ansible_distribution_release }}_backports_preferences' dest: /etc/apt/preferences.d/0-backports-defaults force: yes mode: "0640" @@ -33,7 +33,7 @@ line: 'Acquire::Check-Valid-Until no;' create: yes state: present - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" tags: - apt diff --git a/apt/tasks/basics.yml b/apt/tasks/basics.yml index 9f792a7f..2c736aa9 100644 --- a/apt/tasks/basics.yml +++ b/apt/tasks/basics.yml @@ -2,7 +2,7 @@ - name: Change basics repositories template: - src: "{{ ansible_lsb.codename }}_basics.list.j2" + src: "{{ ansible_distribution_release }}_basics.list.j2" dest: /etc/apt/sources.list mode: "0644" force: yes diff --git a/apt/tasks/evolix_public.yml b/apt/tasks/evolix_public.yml index e5a15279..3e00a602 100644 --- a/apt/tasks/evolix_public.yml +++ b/apt/tasks/evolix_public.yml @@ -3,7 +3,7 @@ # - name: Fail if distribution is not supported # fail: # msg: "Error: Evolix public repository is not compatble with 'Debian Stretch' yet." -# when: ansible_lsb.codename == "stretch" +# when: ansible_distribution_release == "stretch" # tags: # - apt diff --git a/apt/templates/evolix_public.list.j2 b/apt/templates/evolix_public.list.j2 index 952588d0..d5318e29 100644 --- a/apt/templates/evolix_public.list.j2 +++ b/apt/templates/evolix_public.list.j2 @@ -1,4 +1,4 @@ # {{ ansible_managed }} -# deb http://pub.evolix.net/ {{ ansible_lsb.codename }}/ +# deb http://pub.evolix.net/ {{ ansible_distribution_release }}/ deb http://pub.evolix.net/ stretch/ diff --git a/bind/tasks/main.yml b/bind/tasks/main.yml index 9dadc3fb..8fdf1692 100644 --- a/bind/tasks/main.yml +++ b/bind/tasks/main.yml @@ -47,7 +47,7 @@ notify: - reload systemd - restart bind - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: touch /var/log/bind.log if non chroot file: diff --git a/docker-host/tasks/main.yml b/docker-host/tasks/main.yml index 86d10437..c15fc761 100644 --- a/docker-host/tasks/main.yml +++ b/docker-host/tasks/main.yml @@ -21,13 +21,13 @@ - name: Add Docker repository apt_repository: - repo: 'deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_lsb.codename }} stable' + repo: 'deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable' state: present update_cache: no filename: docker.list - include: jessie_backports.yml - when: ansible_lsb.codename == 'jessie' + when: ansible_distribution_release == 'jessie' - name: Add Docker's official GPG key apt_key: diff --git a/elasticsearch/tasks/curator.yml b/elasticsearch/tasks/curator.yml index 5b6fdfc8..c7c44259 100644 --- a/elasticsearch/tasks/curator.yml +++ b/elasticsearch/tasks/curator.yml @@ -2,7 +2,7 @@ - name: Use the correct debian repository set_fact: - curator_debian_repository: '{% if ansible_lsb.codename == "jessie" %}debian{% else %}debian9{% endif %}' + curator_debian_repository: '{% if ansible_distribution_release == "jessie" %}debian{% else %}debian9{% endif %}' - name: Curator sources list is available apt_repository: diff --git a/evoacme/tasks/certbot.yml b/evoacme/tasks/certbot.yml index 71825d64..003c92d0 100644 --- a/evoacme/tasks/certbot.yml +++ b/evoacme/tasks/certbot.yml @@ -13,7 +13,7 @@ notify: apt update - meta: flush_handlers - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: Install certbot with apt apt: diff --git a/evolinux-base/tasks/hardware.yml b/evolinux-base/tasks/hardware.yml index cc7e85e5..8607a586 100644 --- a/evolinux-base/tasks/hardware.yml +++ b/evolinux-base/tasks/hardware.yml @@ -57,13 +57,13 @@ apt_key: # url: https://hwraid.le-vert.net/debian/hwraid.le-vert.net.gpg.key data: "{{ lookup('file', 'hwraid.le-vert.net.gpg.key') }}" - when: ansible_lsb.codename == "stretch" + when: ansible_distribution_release == "stretch" - name: Add HW tool repository apt_repository: repo: 'deb http://hwraid.le-vert.net/debian stretch main' state: present - when: ansible_lsb.codename == "stretch" + when: ansible_distribution_release == "stretch" - name: Install packages for DELL/LSI hardware apt: diff --git a/evolinux-base/tasks/packages.yml b/evolinux-base/tasks/packages.yml index b4d9cee1..de710926 100644 --- a/evolinux-base/tasks/packages.yml +++ b/evolinux-base/tasks/packages.yml @@ -134,7 +134,7 @@ when: - evolinux_packages_listchanges - ansible_distribution == "Debian" - - ansible_lsb.codename == "jessie" + - ansible_distribution_release == "jessie" - name: apt-listchanges is absent on Stretch and later apt: diff --git a/evolinux-base/tasks/system.yml b/evolinux-base/tasks/system.yml index 502df7e9..4ef08fa3 100644 --- a/evolinux-base/tasks/system.yml +++ b/evolinux-base/tasks/system.yml @@ -125,7 +125,7 @@ mode: "0755" when: - evolinux_system_alert5_init - - ansible_lsb.codename == "jessie" or ansible_lsb.codename == "stretch" + - ansible_distribution_release == "jessie" or ansible_distribution_release == "stretch" - name: Enable alert5 init script (jessie/stretch) service: @@ -134,7 +134,7 @@ when: - evolinux_system_alert5_init - evolinux_system_alert5_enable - - ansible_lsb.codename == "jessie" or ansible_lsb.codename == "stretch" + - ansible_distribution_release == "jessie" or ansible_distribution_release == "stretch" diff --git a/evolinux-users/tasks/sudo.yml b/evolinux-users/tasks/sudo.yml index a4b28d25..ed696b43 100644 --- a/evolinux-users/tasks/sudo.yml +++ b/evolinux-users/tasks/sudo.yml @@ -1,7 +1,7 @@ --- - include: sudo_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: sudo_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/fluentd/tasks/main.yml b/fluentd/tasks/main.yml index 30a4f0bf..41c532d1 100644 --- a/fluentd/tasks/main.yml +++ b/fluentd/tasks/main.yml @@ -10,7 +10,7 @@ - name: Fluentd sources list is available apt_repository: - repo: "deb http://packages.treasuredata.com/3/debian/{{ ansible_lsb.codename }}/ {{ ansible_lsb.codename }} contrib" + repo: "deb http://packages.treasuredata.com/3/debian/{{ ansible_distribution_release }}/ {{ ansible_distribution_release }} contrib" filename: treasuredata update_cache: yes state: present diff --git a/haproxy/templates/haproxy_apt_preferences.j2 b/haproxy/templates/haproxy_apt_preferences.j2 index 144f1bc2..706ee67d 100644 --- a/haproxy/templates/haproxy_apt_preferences.j2 +++ b/haproxy/templates/haproxy_apt_preferences.j2 @@ -1,3 +1,3 @@ Package: haproxy libssl1.0.0 -Pin: release a={{ ansible_lsb.codename }}-backports +Pin: release a={{ ansible_distribution_release }}-backports Pin-Priority: 999 diff --git a/java/tasks/openjdk.yml b/java/tasks/openjdk.yml index 20e1f04c..9b4f0b7d 100644 --- a/java/tasks/openjdk.yml +++ b/java/tasks/openjdk.yml @@ -1,7 +1,7 @@ --- - name: Decide which Debian release to use set_fact: - java_apt_release: '{% if ansible_lsb.codename == "jessie" %}jessie-backports{% else %}{{ ansible_lsb.codename }}{% endif %}' + java_apt_release: '{% if ansible_distribution_release == "jessie" %}jessie-backports{% else %}{{ ansible_distribution_release }}{% endif %}' tags: - java @@ -9,7 +9,7 @@ include_role: name: apt tasks_from: backports.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" tags: - java diff --git a/mongodb/tasks/main.yml b/mongodb/tasks/main.yml index e97ed3a8..a13183c6 100644 --- a/mongodb/tasks/main.yml +++ b/mongodb/tasks/main.yml @@ -3,10 +3,10 @@ # - fail: # msg: only compatible with Debian 8 # when: -# - ansible_distribution != "Debian" or ansible_lsb.codename != "jessie" +# - ansible_distribution != "Debian" or ansible_distribution_release != "jessie" - include: main_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: main_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/mysql-oracle/tasks/utils.yml b/mysql-oracle/tasks/utils.yml index cc2c6233..79587f16 100644 --- a/mysql-oracle/tasks/utils.yml +++ b/mysql-oracle/tasks/utils.yml @@ -22,7 +22,7 @@ - packages - mytop - mysql - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" # - name: "mysql-utilities are installed (Debian 9 or later)" # apt: diff --git a/mysql/tasks/main.yml b/mysql/tasks/main.yml index ff47c6ac..8e14c8de 100644 --- a/mysql/tasks/main.yml +++ b/mysql/tasks/main.yml @@ -7,19 +7,19 @@ when: ansible_distribution_major_version | version_compare('9', '>=') - include: packages_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: users_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') - include: users_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: config_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') - include: config_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: datadir.yml diff --git a/mysql/tasks/utils.yml b/mysql/tasks/utils.yml index e5d48688..1f59f3f1 100644 --- a/mysql/tasks/utils.yml +++ b/mysql/tasks/utils.yml @@ -22,7 +22,7 @@ - packages - mytop - mysql - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "Install depends for mytop (stretch)" apt: @@ -31,7 +31,7 @@ - mariadb-client-10.1 - libconfig-inifiles-perl - libterm-readkey-perl - when: ansible_lsb.codename == "stretch" + when: ansible_distribution_release == "stretch" - name: "Install depends for mytop (Debian 10 or later)" apt: diff --git a/nginx/templates/apt/nginx_preferences b/nginx/templates/apt/nginx_preferences index c0fb042a..84bf65ff 100644 --- a/nginx/templates/apt/nginx_preferences +++ b/nginx/templates/apt/nginx_preferences @@ -1,3 +1,3 @@ Package: nginx nginx-* libnginx-* libssl* -Pin: release a={{ ansible_lsb.codename }}-backports +Pin: release a={{ ansible_distribution_release }}-backports Pin-Priority: 999 diff --git a/nodejs/tasks/main.yml b/nodejs/tasks/main.yml index d0754d52..bad66d95 100644 --- a/nodejs/tasks/main.yml +++ b/nodejs/tasks/main.yml @@ -19,7 +19,7 @@ - name: NodeJS sources list ({{ nodejs_apt_version }}) is available apt_repository: - repo: "deb https://deb.nodesource.com/{{ nodejs_apt_version }} {{ ansible_lsb.codename }} main" + repo: "deb https://deb.nodesource.com/{{ nodejs_apt_version }} {{ ansible_distribution_release }} main" filename: nodesource update_cache: yes state: present diff --git a/packweb-apache/tasks/main.yml b/packweb-apache/tasks/main.yml index 71e479d6..f5d0f35e 100644 --- a/packweb-apache/tasks/main.yml +++ b/packweb-apache/tasks/main.yml @@ -48,7 +48,7 @@ src: userlogrotate_jessie dest: /etc/cron.weekly/userlogrotate mode: "0755" - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "Install userlogrotate (Debian 9 or later)" copy: diff --git a/percona/tasks/main.yml b/percona/tasks/main.yml index 701bba47..cce78c3a 100644 --- a/percona/tasks/main.yml +++ b/percona/tasks/main.yml @@ -1,7 +1,7 @@ --- - set_fact: - percona__apt_config_package_file: "percona-release_latest.{{ ansible_lsb.codename }}_all.deb" + percona__apt_config_package_file: "percona-release_latest.{{ ansible_distribution_release }}_all.deb" - name: Add Percona's official GPG key apt_key: diff --git a/php/tasks/main.yml b/php/tasks/main.yml index 41b93b27..83321bff 100644 --- a/php/tasks/main.yml +++ b/php/tasks/main.yml @@ -6,10 +6,10 @@ - ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<') - include: main_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: main_stretch.yml - when: ansible_lsb.codename == "stretch" + when: ansible_distribution_release == "stretch" - include: main_buster.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/postgresql/tasks/main.yml b/postgresql/tasks/main.yml index 17917abe..3bc1f904 100644 --- a/postgresql/tasks/main.yml +++ b/postgresql/tasks/main.yml @@ -1,7 +1,7 @@ --- - include: packages_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: packages_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/postgresql/tasks/pgdg-repo.yml b/postgresql/tasks/pgdg-repo.yml index 4019aded..dcc63d6f 100644 --- a/postgresql/tasks/pgdg-repo.yml +++ b/postgresql/tasks/pgdg-repo.yml @@ -10,7 +10,7 @@ - name: Add PGDG repository apt_repository: - repo: "deb http://apt.postgresql.org/pub/repos/apt/ {{ansible_lsb.codename}}-pgdg main" + repo: "deb http://apt.postgresql.org/pub/repos/apt/ {{ansible_distribution_release}}-pgdg main" update_cache: yes - name: Add GPG key for PGDG repository diff --git a/postgresql/templates/postgresql.pref.j2 b/postgresql/templates/postgresql.pref.j2 index 608c4dd6..74196cf6 100644 --- a/postgresql/templates/postgresql.pref.j2 +++ b/postgresql/templates/postgresql.pref.j2 @@ -1,3 +1,3 @@ Package: postgresql-{{postgresql_version}} postgresql-client-common postgresql-common libpq5 ptop -Pin: release a={{ansible_lsb.codename}}-pgdg +Pin: release a={{ansible_distribution_release}}-pgdg Pin-Priority: 999 diff --git a/redis/tasks/main.yml b/redis/tasks/main.yml index e75ec8f9..b0dce043 100644 --- a/redis/tasks/main.yml +++ b/redis/tasks/main.yml @@ -93,7 +93,7 @@ - nrpe - include: nrpe_stretch.yml - when: ansible_lsb.codename == "stretch" and nrpe_evolix_config.stat.exists == true + when: ansible_distribution_release == "stretch" and nrpe_evolix_config.stat.exists == true tags: - redis - nrpe diff --git a/squid/tasks/main.yml b/squid/tasks/main.yml index 5dddf87b..17429954 100644 --- a/squid/tasks/main.yml +++ b/squid/tasks/main.yml @@ -8,7 +8,7 @@ - name: "Set squid name (jessie)" set_fact: squid_daemon_name: squid3 - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "Set squid name (Debian 9 or later)" set_fact: @@ -34,7 +34,7 @@ src: squid.conf.j2 dest: /etc/squid3/squid.conf notify: "restart squid3" - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "evolix whitelist is present (jessie)" copy: @@ -42,7 +42,7 @@ dest: /etc/squid3/whitelist.conf force: no notify: "reload squid3" - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "evolinux defaults squid file (Debian 9 or later)" copy: @@ -135,7 +135,7 @@ when: ansible_distribution_major_version | version_compare('9', '>=') - include: logrotate_jessie.yml - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - include: logrotate_stretch.yml when: ansible_distribution_major_version | version_compare('9', '>=') diff --git a/webapps/evoadmin-web/tasks/packages.yml b/webapps/evoadmin-web/tasks/packages.yml index 4dcdd882..0374af22 100644 --- a/webapps/evoadmin-web/tasks/packages.yml +++ b/webapps/evoadmin-web/tasks/packages.yml @@ -19,7 +19,7 @@ with_items: - php-pear - php-log - when: ansible_lsb.codename == "stretch" + when: ansible_distribution_release == "stretch" - name: Install PHP5 packages (jessie) apt: @@ -28,4 +28,4 @@ allow_unauthenticated: yes with_items: - php5-pam - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" diff --git a/webapps/evoadmin-web/tasks/user.yml b/webapps/evoadmin-web/tasks/user.yml index 7dc18a25..460dc28e 100644 --- a/webapps/evoadmin-web/tasks/user.yml +++ b/webapps/evoadmin-web/tasks/user.yml @@ -17,7 +17,7 @@ name: www-evoadmin groups: shadow append: yes - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "Create www-evoadmin (Debian 9 or later)" user: @@ -52,7 +52,7 @@ dest: "{{ evoadmin_document_root }}" version: jessie update: no - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "Clone evoadmin repository (Debian 9 or later)" git: diff --git a/webapps/evoadmin-web/tasks/web.yml b/webapps/evoadmin-web/tasks/web.yml index d9be3b6e..7cd79b96 100644 --- a/webapps/evoadmin-web/tasks/web.yml +++ b/webapps/evoadmin-web/tasks/web.yml @@ -7,7 +7,7 @@ option: "disable_functions" value: "shell-exec,system,passthru,putenv,popen" notify: reload apache2 - when: ansible_lsb.codename == "jessie" + when: ansible_distribution_release == "jessie" - name: "Set custom values for PHP config (Debian 9 or later)" ini_file: From d5751150afb5926e48c48538d0bad6afcdba164b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= Date: Wed, 3 Jul 2019 09:56:17 +0200 Subject: [PATCH 15/23] evolinux-base: spectre-meltdown-checker need binutils --- evolinux-base/tasks/packages.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/evolinux-base/tasks/packages.yml b/evolinux-base/tasks/packages.yml index de710926..89586a72 100644 --- a/evolinux-base/tasks/packages.yml +++ b/evolinux-base/tasks/packages.yml @@ -100,6 +100,7 @@ name: "{{ item }}" with_items: - spectre-meltdown-checker + - binutils when: - evolinux_packages_buster - ansible_distribution_major_version | version_compare('10', '>=') From bb288ca991c076c181d3fda1b2dd5ada883f6c2a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= Date: Wed, 3 Jul 2019 10:07:00 +0200 Subject: [PATCH 16/23] squid: Custom systemd unit file for Debian >=10 Fixes #63 --- squid/files/squid.service | 22 ++++++++++++++++++++++ squid/tasks/main.yml | 13 +++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 squid/files/squid.service diff --git a/squid/files/squid.service b/squid/files/squid.service new file mode 100644 index 00000000..67240beb --- /dev/null +++ b/squid/files/squid.service @@ -0,0 +1,22 @@ +## Copyright (C) 1996-2019 The Squid Software Foundation and contributors +## +## Squid software is distributed under GPLv2+ license and includes +## contributions from numerous individuals and organizations. +## Please see the COPYING and CONTRIBUTORS files for details. +## + +[Unit] +Description=Squid Web Proxy Server +Documentation=man:squid(8) +After=network.target network-online.target nss-lookup.target + +[Service] +Type=forking +PIDFile=/var/run/squid.pid +ExecStartPre=/usr/sbin/squid --foreground -z +ExecStart=/usr/sbin/squid -sYC -f /etc/squid/evolinux-defaults.conf +ExecReload=/bin/kill -HUP $MAINPID +KillMode=mixed + +[Install] +WantedBy=multi-user.target diff --git a/squid/tasks/main.yml b/squid/tasks/main.yml index 17429954..2e50789e 100644 --- a/squid/tasks/main.yml +++ b/squid/tasks/main.yml @@ -29,6 +29,12 @@ dest: /etc/default/squid when: ansible_distribution_major_version | version_compare('9', '>=') +- name: "Set custom systemd unit service (Debian 10 or later)" + copy: + src: squid.service + dst: /etc/systemd/system/squid.service + when: ansible_distribution_major_version | version_compare('10', '>=') + - name: "squid.conf is present (jessie)" template: src: squid.conf.j2 @@ -134,6 +140,13 @@ notify: "reload squid" when: ansible_distribution_major_version | version_compare('9', '>=') +- name: "Reload systemd and restart squid (Debian 10 or later)" + systemd: + name: squid + state: restarted + daemon_reload: yes + when: ansible_distribution_major_version | version_compare('10', '>=') + - include: logrotate_jessie.yml when: ansible_distribution_release == "jessie" From 4e02e8ee946c0aa286ac1c6ac1705fb1b9386a34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= Date: Thu, 4 Jul 2019 17:16:34 +0200 Subject: [PATCH 17/23] squid: typo for copy task --- squid/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/squid/tasks/main.yml b/squid/tasks/main.yml index 2e50789e..f04a08f0 100644 --- a/squid/tasks/main.yml +++ b/squid/tasks/main.yml @@ -32,7 +32,7 @@ - name: "Set custom systemd unit service (Debian 10 or later)" copy: src: squid.service - dst: /etc/systemd/system/squid.service + dest: /etc/systemd/system/squid.service when: ansible_distribution_major_version | version_compare('10', '>=') - name: "squid.conf is present (jessie)" From a7ef7be9736887eaa488f3e1de99e52d28c68a86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= Date: Thu, 4 Jul 2019 17:16:43 +0200 Subject: [PATCH 18/23] evoadmin-web: download sid package for php-log --- webapps/evoadmin-web/tasks/packages.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/webapps/evoadmin-web/tasks/packages.yml b/webapps/evoadmin-web/tasks/packages.yml index 0374af22..be129da5 100644 --- a/webapps/evoadmin-web/tasks/packages.yml +++ b/webapps/evoadmin-web/tasks/packages.yml @@ -12,6 +12,19 @@ - php-pear when: ansible_distribution_major_version | version_compare('10', '>=') +# /!\ Warning, this is a temporary hack +- include_role: + name: remount-usr + +# /!\ Warning, this is a temporary hack +- name: Install PHP packages from sid (Debian 10 and later) + apt: + deb: '{{ item }}' + state: present + with_items: + - 'http://mirror.evolix.org/debian/pool/main/p/php-log/php-log_1.12.9-2_all.deb' + when: ansible_distribution_major_version | version_compare('10', '>=') + - name: Install PHP packages (stretch) apt: name: '{{ item }}' From 755eaab60acc3e658f66e614a14433717205c297 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= Date: Thu, 4 Jul 2019 17:41:59 +0200 Subject: [PATCH 19/23] minifirewall: use systemctl is-enabled Fixes #66 --- minifirewall/files/check_minifirewall | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/minifirewall/files/check_minifirewall b/minifirewall/files/check_minifirewall index 632f3e8a..17943994 100644 --- a/minifirewall/files/check_minifirewall +++ b/minifirewall/files/check_minifirewall @@ -10,7 +10,7 @@ is_alert5_enabled() { if test -f /etc/init.d/alert5; then test -f /etc/rc2.d/S*alert5 else - systemctl is-active alert5 | grep -q "^active$" + systemctl is-enabled alert5 -q fi } From 2d249f18156f04d120ae5bccdc1261bafed347d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Sun, 22 Sep 2019 22:18:09 +0200 Subject: [PATCH 20/23] squid: split systemd tasks into own file --- CHANGELOG.md | 1 + squid/tasks/main.yml | 12 +----------- squid/tasks/systemd.yml | 14 ++++++++++++++ 3 files changed, 16 insertions(+), 11 deletions(-) create mode 100644 squid/tasks/systemd.yml diff --git a/CHANGELOG.md b/CHANGELOG.md index a7b7d2b7..185efb49 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ The **patch** part changes incrementally at each release. ### Changed * elasticsearch: listen on local interface only by default +* squid: split systemd tasks into own file ### Fixed * lxc-php: Don't remove the default pool diff --git a/squid/tasks/main.yml b/squid/tasks/main.yml index f04a08f0..31f03229 100644 --- a/squid/tasks/main.yml +++ b/squid/tasks/main.yml @@ -29,12 +29,6 @@ dest: /etc/default/squid when: ansible_distribution_major_version | version_compare('9', '>=') -- name: "Set custom systemd unit service (Debian 10 or later)" - copy: - src: squid.service - dest: /etc/systemd/system/squid.service - when: ansible_distribution_major_version | version_compare('10', '>=') - - name: "squid.conf is present (jessie)" template: src: squid.conf.j2 @@ -140,11 +134,7 @@ notify: "reload squid" when: ansible_distribution_major_version | version_compare('9', '>=') -- name: "Reload systemd and restart squid (Debian 10 or later)" - systemd: - name: squid - state: restarted - daemon_reload: yes +- include: systemd.yml when: ansible_distribution_major_version | version_compare('10', '>=') - include: logrotate_jessie.yml diff --git a/squid/tasks/systemd.yml b/squid/tasks/systemd.yml new file mode 100644 index 00000000..d4862477 --- /dev/null +++ b/squid/tasks/systemd.yml @@ -0,0 +1,14 @@ +--- + +- name: "Set custom systemd unit service (Debian 10 or later)" + copy: + src: squid.service + dest: /etc/systemd/system/squid.service + when: ansible_distribution_major_version | version_compare('10', '>=') + +- name: "Reload systemd and restart squid (Debian 10 or later)" + systemd: + name: squid + state: restarted + daemon_reload: yes + when: ansible_distribution_major_version | version_compare('10', '>=') From 8f868b861204a26c1cadf1ff862ff0bb757451ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Sun, 22 Sep 2019 22:25:30 +0200 Subject: [PATCH 21/23] evolinux-base: default value for "evolinux_ssh_group" --- CHANGELOG.md | 1 + evolinux-base/defaults/main.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 185efb49..ff624daf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ The **patch** part changes incrementally at each release. ## [Unreleased] ### Added +* evolinux-base: default value for "evolinux_ssh_group" ### Changed * elasticsearch: listen on local interface only by default diff --git a/evolinux-base/defaults/main.yml b/evolinux-base/defaults/main.yml index d4dc13d7..3ffb7040 100644 --- a/evolinux-base/defaults/main.yml +++ b/evolinux-base/defaults/main.yml @@ -123,6 +123,7 @@ evolinux_ssh_password_auth_addresses: "{{ evolinux_default_ssh_password_auth_add evolinux_ssh_match_address: True evolinux_ssh_disable_acceptenv: True evolinux_ssh_allow_current_user: False +evolinux_ssh_group: "evolinux-ssh" ### disabled because of a memory leak # # evolinux users From b31159c9d262b926f26f6bad3145a19ed1982943 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Sun, 22 Sep 2019 22:26:21 +0200 Subject: [PATCH 22/23] evolinux-base: use "evolinux_internal_group" for SSH authentication --- CHANGELOG.md | 1 + evolinux-base/tasks/ssh.yml | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ff624daf..a4197e66 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ The **patch** part changes incrementally at each release. ### Changed * elasticsearch: listen on local interface only by default +* evolinux-base: use "evolinux_internal_group" for SSH authentication * squid: split systemd tasks into own file ### Fixed diff --git a/evolinux-base/tasks/ssh.yml b/evolinux-base/tasks/ssh.yml index 2dab992b..187a26df 100644 --- a/evolinux-base/tasks/ssh.yml +++ b/evolinux-base/tasks/ssh.yml @@ -11,7 +11,7 @@ # only the first instance of the keyword is applied. » # # We want to allow any user from a list of IP addresses to login with password, -# but users of the "{{ evolinux_ssh_group }}" group can't login with password from other IP addresses +# but users of the "{{ evolinux_internal_group }}" group can't login with password from other IP addresses - name: "Security directives for Evolinux (Debian 10 or later)" blockinfile: @@ -20,7 +20,7 @@ block: | Match Address {{ evolinux_ssh_password_auth_addresses | join(',') }} PasswordAuthentication yes - Match Group {{ evolinux_ssh_group }} + Match Group {{ evolinux_internal_group }} PasswordAuthentication no insertafter: EOF validate: '/usr/sbin/sshd -t -f %s' From 1a647d05469e108858686f0d858ef4c7c1423a37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Sun, 22 Sep 2019 22:41:03 +0200 Subject: [PATCH 23/23] evocheck : update (version 19.09) from upstream --- CHANGELOG.md | 1 + evocheck/files/evocheck.sh | 389 ++++++++++++++++++++++--------------- 2 files changed, 237 insertions(+), 153 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a4197e66..5bdbae49 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ The **patch** part changes incrementally at each release. ### Changed * elasticsearch: listen on local interface only by default +* evocheck : update (version 19.09) from upstream * evolinux-base: use "evolinux_internal_group" for SSH authentication * squid: split systemd tasks into own file diff --git a/evocheck/files/evocheck.sh b/evocheck/files/evocheck.sh index 857b7919..4a486ae9 100644 --- a/evocheck/files/evocheck.sh +++ b/evocheck/files/evocheck.sh @@ -59,6 +59,7 @@ detect_os() { 7) DEBIAN_RELEASE="wheezy";; 8) DEBIAN_RELEASE="jessie";; 9) DEBIAN_RELEASE="stretch";; + 10) DEBIAN_RELEASE="buster";; esac fi elif [ "$(uname -s)" = "OpenBSD" ]; then @@ -85,6 +86,9 @@ is_debian_jessie() { is_debian_stretch() { test "${DEBIAN_RELEASE}" = "stretch" } +is_debian_buster() { + test "${DEBIAN_RELEASE}" = "buster" +} debian_release() { printf "%s" "${DEBIAN_RELEASE}" } @@ -159,7 +163,7 @@ check_dpkgwarning() { test -e /etc/apt/apt.conf \ && failed "IS_DPKGWARNING" "/etc/apt/apt.conf is missing" fi - elif is_debian_stretch; then + elif is_debian_stretch || is_debian_buster; then test -e /etc/apt/apt.conf.d/z-evolinux.conf \ || failed "IS_DPKGWARNING" "/etc/apt/apt.conf.d/z-evolinux.conf is missing" fi @@ -196,7 +200,7 @@ check_modsecurity() { fi } check_customsudoers() { - grep -E -qr "umask=0077" /etc/sudoers* || failed "IS_CUSTOMSUDOERS" + grep -E -qr "umask=0077" /etc/sudoers* || failed "IS_CUSTOMSUDOERS" "missing umask=0077 in sudoers file" } check_vartmpfs() { df /var/tmp | grep -q tmpfs || failed "IS_VARTMPFS" "/var/tmp is not a tmpfs" @@ -208,29 +212,30 @@ check_serveurbase() { is_installed serveur-base || failed "IS_SERVEURBASE" "serveur-base package is not installed" } check_logrotateconf() { - test -e /etc/logrotate.d/zsyslog || failed "IS_LOGROTATECONF" + test -e /etc/logrotate.d/zsyslog || failed "IS_LOGROTATECONF" "missing zsyslog in logrotate.d" } check_syslogconf() { grep -q "^# Syslog for Pack Evolix serveur" /etc/*syslog.conf \ - || failed "IS_SYSLOGCONF" + || failed "IS_SYSLOGCONF" "syslog evolix config file missing" } check_debiansecurity() { grep -q "^deb.*security" /etc/apt/sources.list \ - || failed "IS_DEBIANSECURITY" + || failed "IS_DEBIANSECURITY" "missing debian security repository" } check_aptitudeonly() { if is_debian_squeeze || is_debian_wheezy; then - test -e /usr/bin/apt-get && failed "IS_APTITUDEONLY" + test -e /usr/bin/apt-get && failed "IS_APTITUDEONLY" \ + "only aptitude may be enabled on Debian <=7, apt-get should be disabled" fi } check_aptitude() { - if is_debian_jessie || is_debian_stretch; then - test -e /usr/bin/aptitude && failed "IS_APTITUDE" + if is_debian_jessie || is_debian_stretch || is_debian_buster; then + test -e /usr/bin/aptitude && failed "IS_APTITUDE" "aptitude may not be installed on Debian >=8" fi } check_aptgetbak() { - if is_debian_jessie || is_debian_stretch; then - test -e /usr/bin/apt-get.bak && failed "IS_APTGETBAK" + if is_debian_jessie || is_debian_stretch || is_debian_buster; then + test -e /usr/bin/apt-get.bak && failed "IS_APTGETBAK" "missing dpkg-divert apt-get.bak" fi } check_apticron() { @@ -240,28 +245,29 @@ check_apticron() { test "$status" = "fail" || test -e /usr/bin/apt-get.bak || status="fail" if is_debian_squeeze || is_debian_wheezy; then - test "$status" = "fail" && failed "IS_APTICRON" + test "$status" = "fail" && failed "IS_APTICRON" "apticron must be in cron.d not cron.daily" fi } check_usrro() { - grep /usr /etc/fstab | grep -q ro || failed "IS_USRRO" + grep /usr /etc/fstab | grep -q ro || failed "IS_USRRO" "missing ro directive on fstab for /usr" } check_tmpnoexec() { - mount | grep "on /tmp" | grep -q noexec || failed "IS_TMPNOEXEC" + mount | grep "on /tmp" | grep -q noexec || failed "IS_TMPNOEXEC" "/tmp is mounted with exec, should be noexec" } check_mountfstab() { # Test if lsblk available, if not skip this test... LSBLK_BIN=$(command -v lsblk) if test -x "${LSBLK_BIN}"; then for mountPoint in $(${LSBLK_BIN} -o MOUNTPOINT -l -n | grep '/'); do - grep -Eq "$mountPoint\W" /etc/fstab || failed "IS_MOUNT_FSTAB" + grep -Eq "$mountPoint\W" /etc/fstab \ + || failed "IS_MOUNT_FSTAB" "partition(s) detected mounted but no presence in fstab" done fi } check_listchangesconf() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then if is_installed apt-listchanges; then - failed "IS_LISTCHANGESCONF" "apt-listchanges must not be installed on Stretch" + failed "IS_LISTCHANGESCONF" "apt-listchanges must not be installed on Debian >=9" fi else if [ -e "/etc/apt/listchanges.conf" ]; then @@ -276,72 +282,86 @@ check_listchangesconf() { } check_customcrontab() { found_lines=$(grep -c -E "^(17 \*|25 6|47 6|52 6)" /etc/crontab) - test "$found_lines" = 4 && failed "IS_CUSTOMCRONTAB" + test "$found_lines" = 4 && failed "IS_CUSTOMCRONTAB" "missing custom field in crontab" } check_sshallowusers() { - grep -E -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || failed "IS_SSHALLOWUSERS" + grep -E -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config \ + || failed "IS_SSHALLOWUSERS" "missing AllowUsers or AllowGroups directive in sshd_config" } check_diskperf() { - test -e /root/disk-perf.txt || failed "IS_DISKPERF" + perfFile="/root/disk-perf.txt" + test -e $perfFile || failed "IS_DISKPERF" "missing ${perfFile}" } check_tmoutprofile() { grep -sq "TMOUT=" /etc/profile /etc/profile.d/evolinux.sh || failed "IS_TMOUTPROFILE" "TMOUT is not set" } check_alert5boot() { - if [ -n "$(find /etc/rc2.d/ -name 'S*alert5')" ]; then - grep -q "^date" /etc/rc2.d/S*alert5 || failed "IS_ALERT5BOOT" "boot mail is not sent by alert5 init script" + if is_debian_buster; then + grep -qs "^date" /usr/share/scripts/alert5.sh || failed "IS_ALERT5BOOT" "boot mail is not sent by alert5 init script" + test -f /etc/systemd/system/alert5.service || failed "IS_ALERT5BOOT" "alert5 unit file is missing" + systemctl is-enabled alert5 -q || failed "IS_ALERT5BOOT" "alert5 unit is not enabled" else - failed "IS_ALERT5BOOT" "alert5 init script is missing" + if [ -n "$(find /etc/rc2.d/ -name 'S*alert5')" ]; then + grep -q "^date" /etc/rc2.d/S*alert5 || failed "IS_ALERT5BOOT" "boot mail is not sent by alert5 init script" + else + failed "IS_ALERT5BOOT" "alert5 init script is missing" + fi fi } check_alert5minifw() { - if [ -n "$(find /etc/rc2.d/ -name 'S*alert5')" ]; then - grep -q "^/etc/init.d/minifirewall" /etc/rc2.d/S*alert5 \ - || failed "IS_ALERT5MINIFW" "Minifirewall is not started by alert5 init script" + if is_debian_buster; then + grep -qs "^/etc/init.d/minifirewall" /usr/share/scripts/alert5.sh \ + || failed "IS_ALERT5MINIFW" "Minifirewall is not started by alert5 script or script is missing" else - failed "IS_ALERT5MINIFW" "alert5 init script is missing" + if [ -n "$(find /etc/rc2.d/ -name 'S*alert5')" ]; then + grep -q "^/etc/init.d/minifirewall" /etc/rc2.d/S*alert5 \ + || failed "IS_ALERT5MINIFW" "Minifirewall is not started by alert5 init script" + else + failed "IS_ALERT5MINIFW" "alert5 init script is missing" + fi fi } check_minifw() { /sbin/iptables -L -n | grep -q -E "^ACCEPT\s*all\s*--\s*31\.170\.8\.4\s*0\.0\.0\.0/0\s*$" \ - || failed "IS_MINIFW" + || failed "IS_MINIFW" "minifirewall seems not starded" } check_nrpeperms() { if [ -d /etc/nagios ]; then - actual=$(stat --format "%a" /etc/nagios) + nagiosDir="/etc/nagios" + actual=$(stat --format "%a" $nagiosDir) expected="750" - test "$expected" = "$actual" || failed "IS_NRPEPERMS" + test "$expected" = "$actual" || failed "IS_NRPEPERMS" "${nagiosDir} must be ${expected}" fi } check_minifwperms() { if [ -f "$MINIFW_FILE" ]; then actual=$(stat --format "%a" "$MINIFW_FILE") expected="600" - test "$expected" = "$actual" || failed "IS_MINIFWPERMS" + test "$expected" = "$actual" || failed "IS_MINIFWPERMS" "${MINIFW_FILE} must be ${expected}" fi } check_nrpedisks() { NRPEDISKS=$(grep command.check_disk /etc/nagios/nrpe.cfg | grep "^command.check_disk[0-9]" | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1) DFDISKS=$(df -Pl | grep -c -E -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)") - test "$NRPEDISKS" = "$DFDISKS" || failed "IS_NRPEDISKS" + test "$NRPEDISKS" = "$DFDISKS" || failed "IS_NRPEDISKS" "there must be $DFDISKS check_disk in nrpe.cfg" } check_nrpepid() { if ! is_debian_squeeze; then { test -e /etc/nagios/nrpe.cfg \ && grep -q "^pid_file=/var/run/nagios/nrpe.pid" /etc/nagios/nrpe.cfg; - } || failed "IS_NRPEPID" + } || failed "IS_NRPEPID" "missing or wrong pid_file directive in nrpe.cfg" fi } check_grsecprocs() { if uname -a | grep -q grsec; then { grep -q "^command.check_total_procs..sudo" /etc/nagios/nrpe.cfg \ && grep -A1 "^\[processes\]" /etc/munin/plugin-conf.d/munin-node | grep -q "^user root"; - } || failed "IS_GRSECPROCS" + } || failed "IS_GRSECPROCS" "missing munin's plugin processes directive for grsec" fi } check_apachemunin() { if test -e /etc/apache2/apache2.conf; then - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then { test -h /etc/apache2/mods-enabled/status.load \ && test -h /etc/munin/plugins/apache_accesses \ && test -h /etc/munin/plugins/apache_processes \ @@ -381,25 +401,26 @@ check_raidsoft() { { grep -q "^AUTOCHECK=true" /etc/default/mdadm \ && grep -q "^START_DAEMON=true" /etc/default/mdadm \ && grep -qv "^MAILADDR ___MAIL___" /etc/mdadm/mdadm.conf; - } || failed "IS_RAIDSOFT" + } || failed "IS_RAIDSOFT" "missing or wrong config for mdadm" fi } # Verification du LogFormat de AWStats check_awstatslogformat() { if is_installed apache2 awstats; then - grep -qE '^LogFormat=1' /etc/awstats/awstats.conf.local \ - || failed "IS_AWSTATSLOGFORMAT" + awstatsFile="/etc/awstats/awstats.conf.local" + grep -qE '^LogFormat=1' $awstatsFile \ + || failed "IS_AWSTATSLOGFORMAT" "missing or wrong LogFormat directive in $awstatsFile" fi } # Verification de la présence de la config logrotate pour Munin check_muninlogrotate() { { test -e /etc/logrotate.d/munin-node \ && test -e /etc/logrotate.d/munin; - } || failed "IS_MUNINLOGROTATE" + } || failed "IS_MUNINLOGROTATE" "missing lorotate file for munin" } # Verification de l'activation de Squid dans le cas d'un pack mail check_squid() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then squidconffile="/etc/squid/evolinux-custom.conf" else squidconffile="/etc/squid*/squid.conf" @@ -407,19 +428,19 @@ check_squid() { if is_pack_web && (is_installed squid || is_installed squid3); then host=$(hostname -i) # shellcheck disable=SC2086 - http_port=$(grep "http_port" $squidconffile | cut -f 2 -d " ") + http_port=$(grep -E "^http_port\s+[0-9]+" $squidconffile | awk '{ print $2 }') { grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner proxy -j ACCEPT" "$MINIFW_FILE" \ && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d $host -j ACCEPT" "$MINIFW_FILE" \ && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.(1|0/8) -j ACCEPT" "$MINIFW_FILE" \ && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port.* $http_port" "$MINIFW_FILE"; - } || failed "IS_SQUID" + } || failed "IS_SQUID" "missing squid rules in minifirewall" fi } check_evomaintenance_fw() { if [ -f "$MINIFW_FILE" ]; then rulesNumber=$(grep -c "/sbin/iptables -A INPUT -p tcp --sport 5432 --dport 1024:65535 -s .* -m state --state ESTABLISHED,RELATED -j ACCEPT" "$MINIFW_FILE") if [ "$rulesNumber" -lt 2 ]; then - failed "IS_EVOMAINTENANCE_FW" + failed "IS_EVOMAINTENANCE_FW" "missing evomaintenance rules in minifirewall" fi fi } @@ -430,36 +451,36 @@ check_moddeflate() { { test -e $f && grep -q "AddOutputFilterByType DEFLATE text/html text/plain text/xml" $f \ && grep -q "AddOutputFilterByType DEFLATE text/css" $f \ && grep -q "AddOutputFilterByType DEFLATE application/x-javascript application/javascript" $f; - } || failed "IS_MODDEFLATE" + } || failed "IS_MODDEFLATE" "missing AddOutputFilterByType directive for apache mod deflate" fi } # Verification de la conf log2mail check_log2mailrunning() { if is_pack_web && is_installed log2mail; then - pgrep log2mail >/dev/null || failed 'IS_LOG2MAILRUNNING' + pgrep log2mail >/dev/null || failed "IS_LOG2MAILRUNNING" "log2mail is not running" fi } check_log2mailapache() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then conf=/etc/log2mail/config/apache else conf=/etc/log2mail/config/default fi if is_pack_web && is_installed log2mail; then grep -s -q "^file = /var/log/apache2/error.log" $conf \ - || failed "IS_LOG2MAILAPACHE" + || failed "IS_LOG2MAILAPACHE" "missing log2mail directive for apache" fi } check_log2mailmysql() { if is_pack_web && is_installed log2mail; then grep -s -q "^file = /var/log/syslog" /etc/log2mail/config/{default,mysql,mysql.conf} \ - || failed "IS_LOG2MAILMYSQL" + || failed "IS_LOG2MAILMYSQL" "missing log2mail directive for mysql" fi } check_log2mailsquid() { if is_pack_web && is_installed log2mail; then grep -s -q "^file = /var/log/squid.*/access.log" /etc/log2mail/config/* \ - || failed "IS_LOG2MAILSQUID" + || failed "IS_LOG2MAILSQUID" "missing log2mail directive for squid" fi } # Verification si bind est chroote @@ -470,7 +491,7 @@ check_bindchroot() { md5_original=$(md5sum /usr/sbin/named | cut -f 1 -d ' ') md5_chrooted=$(md5sum /var/chroot-bind/usr/sbin/named | cut -f 1 -d ' ') if [ "$md5_original" != "$md5_chrooted" ]; then - failed "IS_BINDCHROOT" "The chrooted bind binary is differet than the original binary" + failed "IS_BINDCHROOT" "the chrooted bind binary is different than the original binary" fi else failed "IS_BINDCHROOT" "bind process is not chrooted" @@ -482,11 +503,11 @@ check_bindchroot() { check_repvolatile() { if is_debian_lenny; then grep -qE "^deb http://volatile.debian.org/debian-volatile" /etc/apt/sources.list \ - || failed "IS_REPVOLATILE" + || failed "IS_REPVOLATILE" "missing debian-volatile repository" fi if is_debian_squeeze; then grep -qE "^deb.*squeeze-updates" /etc/apt/sources.list \ - || failed "IS_REPVOLATILE" + || failed "IS_REPVOLATILE" "missing squeeze-updates repository" fi } # /etc/network/interfaces should be present, we don't manage systemd-network yet @@ -499,7 +520,7 @@ check_network_interfaces() { } # Verify if all if are in auto check_autoif() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then interfaces=$(/sbin/ip address show up | grep "^[0-9]*:" | grep -E -v "(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 2 | tr -d : | cut -d@ -f1 | tr "\n" " ") else interfaces=$(/sbin/ifconfig -s | tail -n +2 | grep -E -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 1 |tr "\n" " ") @@ -521,18 +542,19 @@ check_interfacesgw() { # Verification de la mise en place d'evobackup check_evobackup() { evobackup_found=$(find /etc/cron* -name '*evobackup*' | wc -l) - test "$evobackup_found" -gt 0 || failed "IS_EVOBACKUP" + test "$evobackup_found" -gt 0 || failed "IS_EVOBACKUP" "missing evobackup cron" } # Verification de la presence du userlogrotate check_userlogrotate() { if is_pack_web; then - test -x /etc/cron.weekly/userlogrotate || failed "IS_USERLOGROTATE" + test -x /etc/cron.weekly/userlogrotate || failed "IS_USERLOGROTATE" "missing userlogrotate cron" fi } # Verification de la syntaxe de la conf d'Apache check_apachectl() { if is_installed apache2; then - /usr/sbin/apache2ctl configtest 2>&1 | grep -q "^Syntax OK$" || failed "IS_APACHECTL" + /usr/sbin/apache2ctl configtest 2>&1 | grep -q "^Syntax OK$" \ + || failed "IS_APACHECTL" "apache errors detected, run a configtest" fi } # Check if there is regular files in Apache sites-enabled. @@ -559,7 +581,7 @@ check_apacheipinallow() { | grep -iv "from all" \ | grep -iv "env=" \ | perl -ne 'exit 1 unless (/from( [\da-f:.\/]+)+$/i)' \ - || failed "IS_APACHEIPINALLOW" + || failed "IS_APACHEIPINALLOW" "bad (Allow|Deny) directives in apache" fi } # Check if default Apache configuration file for munin is absent (or empty or commented). @@ -570,7 +592,8 @@ check_muninapacheconf() { muninconf="/etc/apache2/conf-available/munin.conf" fi if is_installed apache2; then - test -e $muninconf && grep -vEq "^( |\t)*#" "$muninconf" && failed "IS_MUNINAPACHECONF" + test -e $muninconf && grep -vEq "^( |\t)*#" "$muninconf" \ + && failed "IS_MUNINAPACHECONF" "default munin configuration may be commented or disabled" fi } # Verification de la priorité du package samba si les backports sont utilisés @@ -578,7 +601,7 @@ check_sambainpriority() { if is_debian_lenny && is_pack_samba; then if grep -qrE "^[^#].*backport" /etc/apt/sources.list{,.d}; then priority=$(grep -E -A2 "^Package:.*samba" /etc/apt/preferences | grep -A1 "^Pin: release a=lenny-backports" | grep "^Pin-Priority:" | cut -f2 -d" ") - test "$priority" -gt 500 || failed "IS_SAMBAPINPRIORITY" + test "$priority" -gt 500 || failed "IS_SAMBAPINPRIORITY" "bad pinning priority for samba" fi fi } @@ -589,7 +612,7 @@ check_kerneluptodate() { kernel_installed_at=$(date -d "$(ls --full-time -lcrt /boot | tail -n1 | awk '{print $6}')" +%s) last_reboot_at=$(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) if [ "$kernel_installed_at" -gt "$last_reboot_at" ]; then - failed "IS_KERNELUPTODATE" + failed "IS_KERNELUPTODATE" "machine is running an outdated kernel, reboot advised" fi fi } @@ -599,7 +622,7 @@ check_uptime() { limit=$(date -d "now - 2 year" +%s) last_reboot_at=$(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) if [ "$limit" -gt "$last_reboot_at" ]; then - failed "IS_UPTIME" + failed "IS_UPTIME" "machine has an uptime of more thant 2 years, reboot on new kernel advised" fi fi } @@ -648,14 +671,17 @@ check_backupuptodate() { fi } check_etcgit() { - (cd /etc; git rev-parse --is-inside-work-tree > /dev/null 2>&1) || failed "IS_ETCGIT" "/etc is not a Git repository" + export GIT_DIR="/etc/.git" GIT_WORK_TREE="/etc" + git rev-parse --is-inside-work-tree > /dev/null 2>&1 \ + || failed "IS_ETCGIT" "/etc is not a git repository" } # Check if /etc/.git/ has read/write permissions for root only. check_gitperms() { - if test -d /etc/.git; then + GIT_DIR="/etc/.git" + if test -d $GIT_DIR; then expected="700" - actual=$(stat -c "%a" /etc/.git/) - [ "$expected" = "$actual" ] || failed "IS_GITPERMS" + actual=$(stat -c "%a" $GIT_DIR) + [ "$expected" = "$actual" ] || failed "IS_GITPERMS" "$GIT_DIR must be $expected" fi } # Check if no package has been upgraded since $limit. @@ -712,15 +738,15 @@ check_tune2fs_m5() { done } check_evolinuxsudogroup() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then if grep -q "^evolinux-sudo:" /etc/group; then grep -q '^%evolinux-sudo ALL=(ALL:ALL) ALL' /etc/sudoers.d/evolinux \ - || failed "IS_EVOLINUXSUDOGROUP" + || failed "IS_EVOLINUXSUDOGROUP" "missing evolinux-sudo directive in sudoers file" fi fi } check_userinadmgroup() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then users=$(grep "^evolinux-sudo:" /etc/group | awk -F: '{print $4}' | tr ',' ' ') for user in $users; do if ! groups "$user" | grep -q adm; then @@ -731,15 +757,17 @@ check_userinadmgroup() { fi } check_apache2evolinuxconf() { - if is_debian_stretch && test -d /etc/apache2; then - { test -L /etc/apache2/conf-enabled/z-evolinux-defaults.conf \ - && test -L /etc/apache2/conf-enabled/zzz-evolinux-custom.conf \ - && test -f /etc/apache2/ipaddr_whitelist.conf; - } || failed "IS_APACHE2EVOLINUXCONF" + if is_debian_stretch || is_debian_buster; then + if test -d /etc/apache2; then + { test -L /etc/apache2/conf-enabled/z-evolinux-defaults.conf \ + && test -L /etc/apache2/conf-enabled/zzz-evolinux-custom.conf \ + && test -f /etc/apache2/ipaddr_whitelist.conf; + } || failed "IS_APACHE2EVOLINUXCONF" "missing custom evolinux apache config" + fi fi } check_backportsconf() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then grep -qsE "^[^#].*backports" /etc/apt/sources.list \ && failed "IS_BACKPORTSCONF" "backports can't be in main sources list" if grep -qsE "^[^#].*backports" /etc/apt/sources.list.d/*.list; then @@ -749,15 +777,19 @@ check_backportsconf() { fi } check_bind9munin() { - if is_debian_stretch && is_installed bind9; then - { test -L /etc/munin/plugins/bind9 \ - && test -e /etc/munin/plugin-conf.d/bind9; - } || failed "IS_BIND9MUNIN" + if is_debian_stretch || is_debian_buster; then + if is_installed bind9; then + { test -L /etc/munin/plugins/bind9 \ + && test -e /etc/munin/plugin-conf.d/bind9; + } || failed "IS_BIND9MUNIN" "missing bind plugin for munin" + fi fi } check_bind9logrotate() { - if is_debian_stretch && is_installed bind9; then - test -e /etc/logrotate.d/bind9 || failed "IS_BIND9LOGROTATE" + if is_debian_stretch || is_debian_buster; then + if is_installed bind9; then + test -e /etc/logrotate.d/bind9 || failed "IS_BIND9LOGROTATE" "missing bind logrotate file" + fi fi } check_broadcomfirmware() { @@ -766,10 +798,10 @@ check_broadcomfirmware() { if ${LSPCI_BIN} | grep -q 'NetXtreme II'; then { is_installed firmware-bnx2 \ && grep -q "^deb http://mirror.evolix.org/debian.* non-free" /etc/apt/sources.list; - } || failed "IS_BROADCOMFIRMWARE" + } || failed "IS_BROADCOMFIRMWARE" "missing non-free repository" fi else - failed "IS_BROADCOMFIRMWARE" "lspci is missing" + failed "IS_BROADCOMFIRMWARE" "lspci not found in ${PATH}" fi } check_hardwareraidtool() { @@ -784,28 +816,31 @@ check_hardwareraidtool() { is_installed cciss-vol-status || failed "IS_HARDWARERAIDTOOL" "cciss-vol-status not installed" fi else - failed "IS_HARDWARERAIDTOOL" "lspci is missing" + failed "IS_HARDWARERAIDTOOL" "lspci not found in ${PATH}" fi } check_log2mailsystemdunit() { - if is_debian_stretch; then - { systemctl -q is-active log2mail.service \ - && test -f /etc/systemd/system/log2mail.service \ - && ! test -f /etc/init.d/log2mail; - } || failed "IS_LOG2MAILSYSTEMDUNIT" + if is_debian_stretch || is_debian_buster; then + systemctl -q is-active log2mail.service \ + || failed "IS_LOG2MAILSYSTEMDUNIT" "log2mail unit not running" + test -f /etc/systemd/system/log2mail.service \ + || failed "IS_LOG2MAILSYSTEMDUNIT" "missing log2mail unit file" + test -f /etc/init.d/log2mail \ + && failed "IS_LOG2MAILSYSTEMDUNIT" "/etc/init.d/log2mail may be deleted (use systemd unit)" fi } check_listupgrade() { - { test -f /etc/cron.d/listupgrade \ - && test -x /usr/share/scripts/listupgrade.sh; - } || failed "IS_LISTUPGRADE" + test -f /etc/cron.d/listupgrade \ + || failed "IS_LISTUPGRADE" "missing listupgrade cron" + test -x /usr/share/scripts/listupgrade.sh \ + || failed "IS_LISTUPGRADE" "missing listupgrade script or not executable" } check_mariadbevolinuxconf() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then if is_installed mariadb-server; then { test -f /etc/mysql/mariadb.conf.d/z-evolinux-defaults.cnf \ && test -f /etc/mysql/mariadb.conf.d/zzz-evolinux-custom.cnf; - } || failed "IS_MARIADBEVOLINUXCONF" + } || failed "IS_MARIADBEVOLINUXCONF" "missing mariadb custom config" fi fi } @@ -862,70 +897,85 @@ check_redis_backup() { check_elastic_backup() { if is_installed elasticsearch; then # You could change the default path in /etc/evocheck.cf - ELASTIC_BACKUP_PATH=${ELASTIC_BACKUP_PATH:-"/home/backup/elasticsearch"} + ELASTIC_BACKUP_PATH=${ELASTIC_BACKUP_PATH:-"/home/backup-elasticsearch"} test -d "$ELASTIC_BACKUP_PATH" || failed "IS_ELASTIC_BACKUP" "Elastic snapshot is missing (${ELASTIC_BACKUP_PATH})" fi } check_mariadbsystemdunit() { - if is_debian_stretch && is_installed mariadb-server; then - { systemctl -q is-active mariadb.service \ - && test -f /etc/systemd/system/mariadb.service.d/evolinux.conf; - } || failed "IS_MARIADBSYSTEMDUNIT" + if is_debian_stretch || is_debian_buster; then + if is_installed mariadb-server; then + if systemctl -q is-active mariadb.service; then + test -f /etc/systemd/system/mariadb.service.d/evolinux.conf \ + || failed "IS_MARIADBSYSTEMDUNIT" "missing systemd override for mariadb unit" + fi + fi fi } check_mysqlmunin() { - if is_debian_stretch && is_installed mariadb-server; then - for file in mysql_bytes mysql_queries mysql_slowqueries \ - mysql_threads mysql_connections mysql_files_tables \ - mysql_innodb_bpool mysql_innodb_bpool_act mysql_innodb_io \ - mysql_innodb_log mysql_innodb_rows mysql_innodb_semaphores \ - mysql_myisam_indexes mysql_qcache mysql_qcache_mem \ - mysql_sorts mysql_tmp_tables; do + if is_debian_stretch || is_debian_buster; then + if is_installed mariadb-server; then + for file in mysql_bytes mysql_queries mysql_slowqueries \ + mysql_threads mysql_connections mysql_files_tables \ + mysql_innodb_bpool mysql_innodb_bpool_act mysql_innodb_io \ + mysql_innodb_log mysql_innodb_rows mysql_innodb_semaphores \ + mysql_myisam_indexes mysql_qcache mysql_qcache_mem \ + mysql_sorts mysql_tmp_tables; do - if [[ ! -L /etc/munin/plugins/$file ]]; then - failed "IS_MYSQLMUNIN" "Munin plugin '$file' is missing" - test "${VERBOSE}" = 1 || break - fi - done + if [[ ! -L /etc/munin/plugins/$file ]]; then + failed "IS_MYSQLMUNIN" "missing munin plugin '$file'" + test "${VERBOSE}" = 1 || break + fi + done + fi fi } check_mysqlnrpe() { - if is_debian_stretch && is_installed mariadb-server; then - nagios_file=~nagios/.my.cnf - - if ! test -f ${nagios_file}; then - failed "IS_MYSQLNRPE" "${nagios_file} is missing" - elif [ "$(stat -c %U ${nagios_file})" != "nagios" ] \ - || [ "$(stat -c %a ${nagios_file})" != "600" ]; then - failed "IS_MYSQLNRPE" "${nagios_file} has wrong permissions" - else - grep -q -F "command[check_mysql]=/usr/lib/nagios/plugins/check_mysql" /etc/nagios/nrpe.d/evolix.cfg \ - || failed "IS_MYSQLNRPE" "check_mysql is missing" + if is_debian_stretch || is_debian_buster; then + if is_installed mariadb-server; then + nagios_file=~nagios/.my.cnf + if ! test -f ${nagios_file}; then + failed "IS_MYSQLNRPE" "${nagios_file} is missing" + elif [ "$(stat -c %U ${nagios_file})" != "nagios" ] \ + || [ "$(stat -c %a ${nagios_file})" != "600" ]; then + failed "IS_MYSQLNRPE" "${nagios_file} has wrong permissions" + else + grep -q -F "command[check_mysql]=/usr/lib/nagios/plugins/check_mysql" /etc/nagios/nrpe.d/evolix.cfg \ + || failed "IS_MYSQLNRPE" "check_mysql is missing" + fi fi fi } check_phpevolinuxconf() { - if is_debian_stretch && is_installed php; then - { test -f /etc/php/7.0/cli/conf.d/z-evolinux-defaults.ini \ - && test -f /etc/php/7.0/cli/conf.d/zzz-evolinux-custom.ini; - } || failed "IS_PHPEVOLINUXCONF" + if is_debian_stretch || is_debian_buster; then + is_debian_stretch && phpVersion="7.0" + is_debian_buster && phpVersion="7.3" + if is_installed php; then + { test -f /etc/php/${phpVersion}/cli/conf.d/z-evolinux-defaults.ini \ + && test -f /etc/php/${phpVersion}/cli/conf.d/zzz-evolinux-custom.ini + } || failed "IS_PHPEVOLINUXCONF" "missing php evolinux config" + fi fi } check_squidlogrotate() { - if is_debian_stretch && is_installed squid; then - grep -q monthly /etc/logrotate.d/squid || failed "IS_SQUIDLOGROTATE" + if is_debian_stretch || is_debian_buster; then + if is_installed squid; then + grep -q monthly /etc/logrotate.d/squid \ + || failed "IS_SQUIDLOGROTATE" "missing squid logrotate file" + fi fi } check_squidevolinuxconf() { - if is_debian_stretch && is_installed squid; then - { grep -qs "^CONFIG=/etc/squid/evolinux-defaults.conf$" /etc/default/squid \ - && test -f /etc/squid/evolinux-defaults.conf \ - && test -f /etc/squid/evolinux-whitelist-defaults.conf \ - && test -f /etc/squid/evolinux-whitelist-custom.conf \ - && test -f /etc/squid/evolinux-acl.conf \ - && test -f /etc/squid/evolinux-httpaccess.conf \ - && test -f /etc/squid/evolinux-custom.conf; - } || failed "IS_SQUIDEVOLINUXCONF" + if is_debian_stretch || is_debian_buster; then + if is_installed squid; then + { grep -qs "^CONFIG=/etc/squid/evolinux-defaults.conf$" /etc/default/squid \ + && test -f /etc/squid/evolinux-defaults.conf \ + && test -f /etc/squid/evolinux-whitelist-defaults.conf \ + && test -f /etc/squid/evolinux-whitelist-custom.conf \ + && test -f /etc/squid/evolinux-acl.conf \ + && test -f /etc/squid/evolinux-httpaccess.conf \ + && test -f /etc/squid/evolinux-custom.conf; + } || failed "IS_SQUIDEVOLINUXCONF" "missing squid evolinux config" + fi fi } check_duplicate_fs_label() { @@ -947,11 +997,12 @@ check_duplicate_fs_label() { fi rm "$tmpFile" else - failed "IS_DUPLICATE_FS_LABEL" "blkid not found" + failed "IS_DUPLICATE_FS_LABEL" "blkid not found in ${PATH}" fi } check_evolix_user() { - grep -q "evolix:" /etc/passwd && failed "IS_EVOLIX_USER" + grep -q "evolix:" /etc/passwd \ + && failed "IS_EVOLIX_USER" "evolix user should be deleted, used only for install" } check_evoacme_cron() { if [ -f "/usr/local/sbin/evoacme" ]; then @@ -989,20 +1040,23 @@ check_apache_confenabled() { # Starting from Jessie and Apache 2.4, /etc/apache2/conf.d/ # must be replaced by conf-available/ and config files symlinked # to conf-enabled/ - if is_debian_jessie || is_debian_stretch; then + if is_debian_jessie || is_debian_stretch || is_debian_buster; then if [ -f /etc/apache2/apache2.conf ]; then - test -d /etc/apache2/conf.d/ && failed "IS_APACHE_CONFENABLED" - grep -q 'Include conf.d' /etc/apache2/apache2.conf && failed "IS_APACHE_CONFENABLED" + test -d /etc/apache2/conf.d/ \ + && failed "IS_APACHE_CONFENABLED" "apache's conf.d directory must not exists" + grep -q 'Include conf.d' /etc/apache2/apache2.conf \ + && failed "IS_APACHE_CONFENABLED" "apache2.conf must not Include conf.d" fi fi } check_meltdown_spectre() { # For Stretch, detection is easy as the kernel use # /sys/devices/system/cpu/vulnerabilities/ - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then for vuln in meltdown spectre_v1 spectre_v2; do test -f "/sys/devices/system/cpu/vulnerabilities/$vuln" \ - || failed "IS_MELTDOWN_SPECTRE" + || failed "IS_MELTDOWN_SPECTRE" "vulnerable to $vuln" + test "${VERBOSE}" = 1 || break done # For Jessie this is quite complicated to verify and we need to use kernel config file elif is_debian_jessie; then @@ -1013,9 +1067,11 @@ check_meltdown_spectre() { # Sometimes autodetection of kernel config file fail, so we test if the file really exists. if [ -f "/boot/${kernelConfig}" ]; then grep -Eq '^CONFIG_PAGE_TABLE_ISOLATION=y' "/boot/$kernelConfig" \ - || failed "IS_MELTDOWN_SPECTRE" "PAGE_TABLE_ISOLATION vulnerability is not patched" + || failed "IS_MELTDOWN_SPECTRE" \ + "PAGE_TABLE_ISOLATION must be enabled in kernel, outdated kernel?" grep -Eq '^CONFIG_RETPOLINE=y' "/boot/$kernelConfig" \ - || failed "IS_MELTDOWN_SPECTRE" "RETPOLINE vulnerability is not patched" + || failed "IS_MELTDOWN_SPECTRE" \ + "RETPOLINE must be enabled in kernel, outdated kernel?" fi fi fi @@ -1036,29 +1092,31 @@ check_old_home_dir() { check_tmp_1777() { actual=$(stat --format "%a" /tmp) expected="1777" - test "$expected" = "$actual" || failed "IS_TMP_1777" + test "$expected" = "$actual" || failed "IS_TMP_1777" "/tmp must be $expected" } check_root_0700() { actual=$(stat --format "%a" /root) expected="700" - test "$expected" = "$actual" || failed "IS_ROOT_0700" + test "$expected" = "$actual" || failed "IS_ROOT_0700" "/root must be $expected" } check_usrsharescripts() { actual=$(stat --format "%a" /usr/share/scripts) expected="700" - test "$expected" = "$actual" || failed "IS_USRSHARESCRIPTS" + test "$expected" = "$actual" || failed "IS_USRSHARESCRIPTS" "/usr/share/scripts must be $expected" } check_sshpermitrootno() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then if grep -q "^PermitRoot" /etc/ssh/sshd_config; then - grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || failed "IS_SSHPERMITROOTNO" + grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config \ + || failed "IS_SSHPERMITROOTNO" "PermitRoot should be set at no" fi else - grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || failed "IS_SSHPERMITROOTNO" + grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config \ + || failed "IS_SSHPERMITROOTNO" "PermitRoot should be set at no" fi } check_evomaintenanceusers() { - if is_debian_stretch; then + if is_debian_stretch || is_debian_buster; then users=$(getent group evolinux-sudo | cut -d':' -f4 | tr ',' ' ') else if [ -f /etc/sudoers.d/evolinux ]; then @@ -1126,7 +1184,30 @@ check_evobackup_incs() { check_osprober() { if is_installed os-prober qemu-kvm; then - failed "IS_OSPROBER" "Removal of os-prober package is recommended as it can cause serious issue on KVM server" + failed "IS_OSPROBER" \ + "Removal of os-prober package is recommended as it can cause serious issue on KVM server" + fi +} + +check_jessie_backports() { + if is_debian_jessie; then + jessieBackports=$(grep -hs "jessie-backports" /etc/apt/sources.list /etc/apt/sources.list.d/*) + if test -n "$jessieBackports"; then + if ! grep -q "archive.debian.org" <<< "$jessieBackports"; then + failed "IS_JESSIE_BACKPORTS" "You must use deb http://archive.debian.org/debian/ jessie-backports main" + fi + fi + fi +} + +check_apt_valid_until() { + aptvalidFile="/etc/apt/apt.conf.d/99no-check-valid-until" + aptvalidText="Acquire::Check-Valid-Until no;" + if grep -qs "archive.debian.org" /etc/apt/sources.list /etc/apt/sources.list.d/*; then + if ! grep -qs "$aptvalidText" /etc/apt/apt.conf.d/*; then + failed "IS_APT_VALID_UNTIL" \ + "As you use archive.mirror.org you need ${aptvalidFile}: ${aptvalidText}" + fi fi } @@ -1251,6 +1332,8 @@ main() { test "${IS_OLD_HOME_DIR:=1}" = 1 && check_old_home_dir test "${IS_EVOBACKUP_INCS:=1}" = 1 && check_evobackup_incs test "${IS_OSPROBER:=1}" = 1 && check_osprober + test "${IS_JESSIE_BACKPORTS:=1}" = 1 && check_jessie_backports + test "${IS_APT_VALID_UNTIL:=1}" = 1 && check_apt_valid_until fi #----------------------------------------------------------- @@ -1363,7 +1446,7 @@ readonly PROGDIR=$(realpath -m "$(dirname "$0")") # shellcheck disable=2124 readonly ARGS=$@ -readonly VERSION="19.06" +readonly VERSION="19.09" # Disable LANG* export LANG=C