Update..

2021-08-23 21:32:31 +02:00
parent 99f0f4c460
commit 707e261c13
50 changed files with 710 additions and 398 deletions
--- a/roles/common/files/etc/sysctl.d/20-dovecot.conf
+++ b/roles/common/files/etc/sysctl.d/20-dovecot.conf
@ -0,0 +1,7 @@
+# Setting need by mailserver (dovecot) 
+# -
+# - Warning messages from dovecot:
+# - Warning: Inotify instance limit for user 5000 (UID vmail) exceeded, disabling.
+# -          Increase /proc/sys/fs/inotify/max_user_instances
+# -
+fs.inotify.max_user_instances = 2048
--- a/roles/common/files/etc/sysctl.d/20-redis.conf
+++ b/roles/common/files/etc/sysctl.d/20-redis.conf
@ -0,0 +1,30 @@
+# -----
+# Running Redis Service (on LX-Container)
+#
+# See also changes at file /etc/rc.local
+# -----
+
+# Got this warning on redis logfile at LX-Container
+#
+#    # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn
+#    is set to the lower value of 128
+#
+net.core.somaxconn = 65535
+
+# Redis Server says:
+#
+# WARNING overcommit_memory is set to 0! Background save may fail under
+# low memory condition. To fix this issue add 'vm.overcommit_memory = 1'
+# to /etc/sysctl.conf and then reboot or run the command
+# 'sysctl vm.overcommit_memory=1' for this to take effect.
+vm.overcommit_memory = 1
+
+# increase Linux TCP buffer limits
+net.core.rmem_max = 67108864
+net.core.wmem_max = 67108864
+net.core.netdev_max_backlog = 262144
+
+# increase Linux autotuning TCP buffer limits
+# min, default, and max number of bytes to use
+net.ipv4.tcp_rmem = 4096 87380 33554432
+net.ipv4.tcp_wmem = 4096 87380 33554432
--- a/roles/common/files/etc/sysctl.d/20-swappiness.conf
+++ b/roles/common/files/etc/sysctl.d/20-swappiness.conf
@ -0,0 +1 @@
+vm.swappiness = 0
--- a/roles/common/files/etc/sysctl.d/90-ddos.conf
+++ b/roles/common/files/etc/sysctl.d/90-ddos.conf
@ -0,0 +1,82 @@
+# ==========
+# Anti-DDoS Kernel Settings
+# ==========
+
+# see:
+#    https://javapipe.com/blog/iptables-ddos-protection/
+
+# These sysctl.conf settings help to maximize the performance of your server
+# under DDoS as well as the effectiveness of the iptables rules that we’re going
+# to provide in this guide.
+kernel.printk = 4 4 1 7
+kernel.panic = 10
+kernel.sysrq = 0
+kernel.shmmax = 4294967296
+kernel.shmall = 4194304
+kernel.core_uses_pid = 1
+kernel.msgmnb = 65536
+kernel.msgmax = 65536
+vm.swappiness = 20
+vm.dirty_ratio = 80
+vm.dirty_background_ratio = 5
+fs.file-max = 2097152
+net.core.netdev_max_backlog = 262144
+net.core.rmem_default = 31457280
+net.core.rmem_max = 67108864
+net.core.wmem_default = 31457280
+net.core.wmem_max = 67108864
+net.core.somaxconn = 65535
+net.core.optmem_max = 25165824
+net.ipv4.neigh.default.gc_thresh1 = 4096
+net.ipv4.neigh.default.gc_thresh2 = 8192
+net.ipv4.neigh.default.gc_thresh3 = 16384
+net.ipv4.neigh.default.gc_interval = 5
+net.ipv4.neigh.default.gc_stale_time = 120
+net.netfilter.nf_conntrack_max = 10000000
+net.netfilter.nf_conntrack_tcp_loose = 0
+net.netfilter.nf_conntrack_tcp_timeout_established = 1800
+net.netfilter.nf_conntrack_tcp_timeout_close = 10
+net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
+net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 20
+net.netfilter.nf_conntrack_tcp_timeout_last_ack = 20
+net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 20
+net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 20
+net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10
+net.ipv4.tcp_slow_start_after_idle = 0
+net.ipv4.ip_local_port_range = 1024 65000
+net.ipv4.ip_no_pmtu_disc = 1
+net.ipv4.route.flush = 1
+net.ipv4.route.max_size = 8048576
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+net.ipv4.tcp_congestion_control = htcp
+net.ipv4.tcp_mem = 65536 131072 262144
+net.ipv4.udp_mem = 65536 131072 262144
+net.ipv4.tcp_rmem = 4096 87380 33554432
+net.ipv4.udp_rmem_min = 16384
+net.ipv4.tcp_wmem = 4096 87380 33554432
+net.ipv4.udp_wmem_min = 16384
+net.ipv4.tcp_max_tw_buckets = 1440000
+net.ipv4.tcp_tw_recycle = 0
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.tcp_max_orphans = 400000
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.tcp_rfc1337 = 1
+net.ipv4.tcp_syncookies = 1
+net.ipv4.tcp_synack_retries = 1
+net.ipv4.tcp_syn_retries = 2
+net.ipv4.tcp_max_syn_backlog = 16384
+net.ipv4.tcp_timestamps = 1
+net.ipv4.tcp_sack = 1
+net.ipv4.tcp_fack = 1
+net.ipv4.tcp_ecn = 2
+net.ipv4.tcp_fin_timeout = 10
+net.ipv4.tcp_keepalive_time = 600
+net.ipv4.tcp_keepalive_intvl = 60
+net.ipv4.tcp_keepalive_probes = 10
+net.ipv4.tcp_no_metrics_save = 1
+net.ipv4.ip_forward = 0
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.all.rp_filter = 1
--- a/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitCORE.conf
+++ b/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitCORE.conf
@ -0,0 +1,4 @@
+# Custom Values overrides '/etc/systemd/system.conf'
+#
+[Manager]
+DefaultLimitCORE=infinity
--- a/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitNOFILE.conf
+++ b/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitNOFILE.conf
@ -0,0 +1,4 @@
+# Custom Values overrides '/etc/systemd/system.conf'
+#
+[Manager]
+DefaultLimitNOFILE=1048576
--- a/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitNPROC.conf
+++ b/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitNPROC.conf
@ -0,0 +1,4 @@
+# Custom Values overrides '/etc/systemd/system.conf'
+#
+[Manager]
+DefaultLimitNPROC=65000
--- a/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitRTPRIO.conf
+++ b/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitRTPRIO.conf
@ -0,0 +1,4 @@
+# Custom Values overrides '/etc/systemd/system.conf'
+#
+[Manager]
+DefaultLimitRTPRIO=infinity
--- a/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitRTTIME.conf
+++ b/roles/common/files/etc/systemd/system.conf.d/20-DefaultLimitRTTIME.conf
@ -0,0 +1,4 @@
+# Custom Values overrides '/etc/systemd/system.conf'
+#
+[Manager]
+DefaultLimitRTTIME=infinity
--- a/roles/common/files/etc/systemd/system.conf.d/20-DefaultTasksMax.conf
+++ b/roles/common/files/etc/systemd/system.conf.d/20-DefaultTasksMax.conf
@ -0,0 +1,4 @@
+# Custom Values overrides '/etc/systemd/system.conf'
+#
+[Manager]
+DefaultTasksMax=65000
--- a/roles/common/tasks/basic.yml
+++ b/roles/common/tasks/basic.yml
@ -24,22 +24,80 @@
  tags:
    - symlink-sh

- name: (basic.yml) Check file '/etc/systemd/system.conf' exists
-  stat:
-    path: /etc/systemd/system
-  register: etc_systemd_system_conf
-  when:
-    - set_default_limit_nofile|bool == true
-
- name: (basic.yml) Change DefaultLimitNOFILE to 1048576
-  lineinfile:
-    dest: /etc/systemd/system.conf
-    state: present
-    regexp: '^DefaultLimitNOFILE'
-    line: 'DefaultLimitNOFILE=1048576'
-    insertafter: '^#DefaultLimitNOFILE'
-  when:
-    - set_default_limit_nofile|bool == true
-    -  etc_systemd_system_conf.stat.exists == true
+- name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists
+  file:
+    path: /etc/systemd/system.conf.d
+    state: directory
+    mode: 0755
+    group: root
+    owner: root
+  when: 
+    - copy_plain_files_systemd is defined
+    - copy_plain_files_systemd|length > 0
  tags:
-    - systemd-nofiles
+    - systemd-config
+
+- name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists
+  copy:
+    src: '{{ item.src_path }}'
+    dest: '{{ item.dest_path }}'
+    owner: root
+    group: root
+    mode: '0644'
+  loop: "{{ copy_plain_files_systemd }}"
+  loop_control:
+    label: 'dest: {{ item.name }}'
+  when: 
+    - copy_plain_files_systemd is defined
+    - copy_plain_files_systemd|length > 0
+  tags:
+    - systemd-config
+
+- name: (basic.yml) Ensure directory '/etc/sysctl.d' exists
+  file:
+    path: etc/sysctl.d
+    state: directory
+    mode: 0755
+    group: root
+    owner: root
+  when: 
+    - copy_plain_files_sysctl is defined
+    - copy_plain_files_sysctl|length > 0
+  tags:
+    - systctl-config
+
+- name: (basic.yml) Ensure files /etc/sysctl.d/*.conf exists
+  copy:
+    src: '{{ item.src_path }}'
+    dest: '{{ item.dest_path }}'
+    owner: root
+    group: root
+    mode: '0644'
+  loop: "{{ copy_plain_files_sysctl }}"
+  loop_control:
+    label: 'dest: {{ item.name }}'
+  when: 
+    - copy_plain_files_sysctl is defined
+    - copy_plain_files_sysctl|length > 0
+  tags:
+    - systctl-config
+
+#- name: (basic.yml) Check file '/etc/systemd/system.conf' exists
+#  stat:
+#    path: /etc/systemd/system
+#  register: etc_systemd_system_conf
+#  when:
+#    - set_default_limit_nofile|bool == true
+#
+#- name: (basic.yml) Change DefaultLimitNOFILE to 1048576
+#  lineinfile:
+#    dest: /etc/systemd/system.conf
+#    state: present
+#    regexp: '^DefaultLimitNOFILE'
+#    line: 'DefaultLimitNOFILE=1048576'
+#    insertafter: '^#DefaultLimitNOFILE'
+#  when:
+#    - set_default_limit_nofile|bool == true
+#    - etc_systemd_system_conf.stat.exists == true
+#  tags:
+#    - systemd-nofiles
--- a/roles/common/tasks/sshd.yml
+++ b/roles/common/tasks/sshd.yml
@ -60,6 +60,8 @@
  notify: "Restart ssh"
  when:
    - create_sftp_group is defined and not create_sftp_group
+    - ansible_facts['distribution'] == "Debian"
+    - ansible_facts['distribution_major_version'] <= "10"
  tags:
    - sshd-config

@ -74,6 +76,46 @@
  notify: "Restart ssh"
  when:
    - create_sftp_group is defined and create_sftp_group
+    - ansible_facts['distribution'] == "Debian"
+    - ansible_facts['distribution_major_version'] <= "10"
+  tags:
+    - sshd-config
+
+- name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'..
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^Subsystem\s+sftp(.+)$'
+    state: absent
+  check_mode: yes
+  changed_when: false
+  register: sshd_config_sftp
+  tags:
+    - sshd-config
+
+- name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists
+  file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+    mode: 0755
+    group: root
+    owner: root
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - ansible_facts['distribution_major_version'] > "10"
+  tags:
+    - sshd-config
+
+- name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2
+  template:
+    src: etc/ssh/sshd_config.j2
+    dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify: "Restart ssh"
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - ansible_facts['distribution_major_version'] > "10"
  tags:
    - sshd-config

--- a/roles/common/tasks/sudoers.yml
+++ b/roles/common/tasks/sudoers.yml
@ -25,16 +25,16 @@
  tags:
    - sudoers-remove

- name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/)
-  template:
-    src: etc/sudoers.d/50-user.j2
-    dest: /etc/sudoers.d/50-user
-    #validate: visudo -cf %s
-    owner: root
-    group: root
-    mode: 0440
-  tags:
-    - sudoers-file-configuration
+#- name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/)
+#  template:
+#    src: etc/sudoers.d/50-user.j2
+#    dest: /etc/sudoers.d/50-user
+#    #validate: visudo -cf %s
+#    owner: root
+#    group: root
+#    mode: 0440
+#  tags:
+#    - sudoers-file-configuration

 - name: (sudoers.yml) update global sudoers configuration file
  template:
--- a/roles/common/templates/etc/ssh/sshd_config.j2
+++ b/roles/common/templates/etc/ssh/sshd_config.j2
@ -382,7 +382,15 @@ AcceptEnv LANG LC_*

 # Configures an external subsystem (e.g. file transfer daemon).
 # By default no subsystems are defined.
+{% if ansible_facts['distribution_major_version'] | int >= 11 %}
+{% if sshd_config_sftp.found|int == 0 %}
 Subsystem sftp /usr/lib/openssh/sftp-server
+{% else %}
+#Subsystem sftp /usr/lib/openssh/sftp-server
+{% endif %}
+{% else %}
+Subsystem sftp /usr/lib/openssh/sftp-server
+{% endif %}

 # Specifies whether sshd(8) should look up the remote host name and check 
 # that the resolved host name for the remote IP address maps back to the