Completed 'services' role + tested on empty node. I also moved task from the main playbook to the 'common' role to better reflect the actions taken by each role
This commit is contained in:
@@ -0,0 +1,60 @@
|
||||
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
|
||||
|
||||
driftfile /var/lib/ntp/ntp.drift
|
||||
|
||||
# Leap seconds definition provided by tzdata
|
||||
leapfile /usr/share/zoneinfo/leap-seconds.list
|
||||
|
||||
# Enable this if you want statistics to be logged.
|
||||
#statsdir /var/log/ntpstats/
|
||||
|
||||
statistics loopstats peerstats clockstats
|
||||
filegen loopstats file loopstats type day enable
|
||||
filegen peerstats file peerstats type day enable
|
||||
filegen clockstats file clockstats type day enable
|
||||
|
||||
# Specify one or more NTP servers.
|
||||
|
||||
# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
|
||||
# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
|
||||
# more information.
|
||||
pool pool.ntp.org
|
||||
server 0.uk.pool.ntp.org iburst
|
||||
server 1.uk.pool.ntp.org
|
||||
server 127.0.0.1
|
||||
|
||||
# Use Ubuntu's ntp server as a fallback.
|
||||
pool ntp.ubuntu.com
|
||||
|
||||
# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
|
||||
# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
|
||||
# might also be helpful.
|
||||
#
|
||||
# Note that "restrict" applies to both servers and clients, so a configuration
|
||||
# that might be intended to block requests from certain clients could also end
|
||||
# up blocking replies from your own upstream servers.
|
||||
|
||||
# By default, exchange time with everybody, but don't allow configuration.
|
||||
restrict -4 default kod notrap nomodify nopeer noquery limited
|
||||
restrict -6 default kod notrap nomodify nopeer noquery limited
|
||||
|
||||
# Local users may interrogate the ntp server more closely.
|
||||
restrict 127.0.0.1
|
||||
restrict ::1
|
||||
|
||||
# Needed for adding pool entries
|
||||
restrict source notrap nomodify noquery
|
||||
|
||||
# Clients from this (example!) subnet have unlimited access, but only if
|
||||
# cryptographically authenticated.
|
||||
#restrict 192.168.123.0 mask 255.255.255.0 notrust
|
||||
|
||||
|
||||
# If you want to provide time to your local subnet, change the next line.
|
||||
# (Again, the address is an example only.)
|
||||
#broadcast 192.168.123.255
|
||||
|
||||
# If you want to listen to time broadcasts on your local subnet, de-comment the
|
||||
# next lines. Please do this only if you trust everybody on the network!
|
||||
#disable auth
|
||||
#broadcastclient
|
||||
@@ -0,0 +1,55 @@
|
||||
#Options
|
||||
|
||||
options {
|
||||
create-dirs(yes);
|
||||
owner(administrator);
|
||||
group(administrator);
|
||||
perm(0640);
|
||||
dir-owner(administrator);
|
||||
dir-group(administrator);
|
||||
dir-perm(0750);
|
||||
};
|
||||
|
||||
#Sources
|
||||
|
||||
source s_regular { tcp(port(5140)); };
|
||||
source s_cisco { tcp(port(5141) flags(no-parse,store-raw-message)); };
|
||||
source s_servers { tcp(port(5142) flags(no-parse,store-raw-message)); };
|
||||
|
||||
#Templates
|
||||
|
||||
template t_jsonfile {
|
||||
template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --key ISODATE)\n");
|
||||
};
|
||||
|
||||
#Parsers
|
||||
|
||||
parser p_cisco { cisco-parser(); };
|
||||
|
||||
#Destinations
|
||||
|
||||
destination d_raw {
|
||||
file("/home/administrator/Desktop/SYSLOG/RAW_LOGS/$HOST-$YEAR-$MONTH-$DAY.log" template("${RAWMSG}\n"));
|
||||
};
|
||||
destination d_from_cisco {
|
||||
file("/home/administrator/Desktop/SYSLOG/CISCO_DEVICES/$HOST-$YEAR-$MONTH-$DAY.log" template(t_jsonfile));
|
||||
};
|
||||
destination d_from_servers {
|
||||
file("/home/administrator/Desktop/SYSLOG/SERVERS/$HOST-$YEAR-$MONTH-$DAY.log" );
|
||||
};
|
||||
|
||||
#Loggers
|
||||
|
||||
log {
|
||||
source(s_regular);
|
||||
destination(d_raw);
|
||||
};
|
||||
log {
|
||||
source(s_cisco);
|
||||
parser(p_cisco);
|
||||
destination(d_from_cisco);
|
||||
};
|
||||
log {
|
||||
source(s_servers);
|
||||
destination(d_from_servers);
|
||||
};
|
||||
@@ -0,0 +1,6 @@
|
||||
# /etc/default/tftpd-hpa
|
||||
|
||||
TFTP_USERNAME="tftp"
|
||||
TFTP_DIRECTORY="/home/administrator/Desktop/TFTP"
|
||||
TFTP_ADDRESS=":69"
|
||||
TFTP_OPTIONS="--secure --create"
|
||||
@@ -0,0 +1,46 @@
|
||||
listen=YES
|
||||
listen_ipv6=NO
|
||||
anonymous_enable=NO
|
||||
local_enable=YES
|
||||
write_enable=YES
|
||||
local_umask=022
|
||||
dirmessage_enable=YES
|
||||
use_localtime=YES
|
||||
xferlog_enable=YES
|
||||
connect_from_port_20=YES
|
||||
chroot_local_user=YES
|
||||
secure_chroot_dir=/var/run/vsftpd/empty
|
||||
pam_service_name=vsftpd
|
||||
rsa_cert_file=/etc/ssl/certs/sftp.ubuntu.dnaclab.net.pem
|
||||
rsa_private_key_file=/etc/ssl/private/sftp.ubuntu.dnaclab.net.key
|
||||
ssl_enable=NO
|
||||
pasv_enable=YES
|
||||
pasv_min_port=10000
|
||||
pasv_max_port=10100
|
||||
allow_writeable_chroot=YES
|
||||
|
||||
# Below verbose log is for transfer/upload, formatted for common tools stats.
|
||||
# Use command: tail -f /var/log/xferlog
|
||||
xferlog_enable=YES
|
||||
xferlog_file=/var/log/xferlog
|
||||
xferlog_std_format=YES
|
||||
|
||||
# Below verbose log is for FTP commands and responses.
|
||||
# By default, logs were written to syslog instead of file.
|
||||
# Use command: tail -f /var/log/vsftpd.log
|
||||
# Use command: logread -f
|
||||
|
||||
log_ftp_protocol=YES
|
||||
vsftpd_log_file=/var/log/vsftpd.log
|
||||
syslog_enable=YES
|
||||
|
||||
# Allow log 1 and 2 to be written simultaneously.
|
||||
|
||||
dual_log_enable=YES
|
||||
|
||||
#Directory configuration and user access
|
||||
|
||||
local_root=/home/administrator/Desktop/SFTP
|
||||
userlist_enable=YES
|
||||
userlist_file=/etc/vsftpd.userlist
|
||||
userlist_deny=NO
|
||||
@@ -1,17 +1,17 @@
|
||||
---
|
||||
- name: Install required packages
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ item }}"
|
||||
loop:
|
||||
- curl
|
||||
- tree
|
||||
- ufw
|
||||
- ntp
|
||||
- tftpd-hpa
|
||||
- syslog-ng
|
||||
- vsftpd
|
||||
- tftpd-hpa
|
||||
- ntp
|
||||
- ufw
|
||||
|
||||
- name: Configure UFW to allow inbound NTP, SSH, SYSLOG, FTP connections
|
||||
- name: Configure UFW to allow inbound NTP, SSH, SYSLOG, FTP and TFTP connections
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
direction: in
|
||||
@@ -37,7 +37,7 @@
|
||||
- port: '5142'
|
||||
proto: tcp
|
||||
|
||||
- name: UFW - Deny all other incoming traffic by default
|
||||
- name: Deny all other incoming IPv4 traffic
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
policy: deny
|
||||
@@ -51,9 +51,54 @@
|
||||
|
||||
- name: Apply NTP configuration file
|
||||
ansible.builtin.copy:
|
||||
src: ./configuration_files/ntp.conf
|
||||
src: ntp.conf
|
||||
dest: /etc/ntp.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
|
||||
- name: Apply TFTP configuration file
|
||||
ansible.builtin.copy:
|
||||
src: tftpd-hpa
|
||||
dest: /etc/default/tftpd-hpa
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
|
||||
- name: Create TFTP directory
|
||||
ansible.builtin.file:
|
||||
path: "/home/{{ ansible_user }}/Desktop/TFTP"
|
||||
state: directory
|
||||
owner: "{{ ansible_user }}"
|
||||
group: "{{ ansible_user }}"
|
||||
mode: '0777'
|
||||
|
||||
- name: Apply SYSLOG configuration file
|
||||
ansible.builtin.copy:
|
||||
src: syslog-ng-network-devices.conf
|
||||
dest: /etc/syslog-ng/conf.d/syslog-ng-network-devices.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
|
||||
- name: Apply FTP configuration file
|
||||
ansible.builtin.copy:
|
||||
src: vsftpd.conf
|
||||
dest: /etc/vsftpd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
|
||||
- name: Enable installed services
|
||||
ansible.builtin.service:
|
||||
name: "{{ item }}"
|
||||
enabled: yes
|
||||
loop:
|
||||
- ntp
|
||||
- tftpd-hpa
|
||||
- syslog-ng
|
||||
- vsftpd
|
||||
Reference in New Issue
Block a user