X-Git-Url: https://gerrit.akraino.org/r/gitweb?a=blobdiff_plain;f=roles%2Fops-hardening%2Ftasks%2Fmain.yaml;h=fdf6512a635c7e7edc89e29d4acbfe54e8515ce9;hb=2dfb03eebd138f9c7d52d962ab7468eb248fd23e;hp=90a57a21789341db0a74f8b876ee19673a0959f0;hpb=3af9a356135ef1622e46dfafd215ebcea2db5bac;p=ta%2Finfra-ansible.git

diff --git a/roles/ops-hardening/tasks/main.yaml b/roles/ops-hardening/tasks/main.yaml
index 90a57a2..fdf6512 100644
--- a/roles/ops-hardening/tasks/main.yaml
+++ b/roles/ops-hardening/tasks/main.yaml
@@ -76,7 +76,13 @@
   lineinfile:
     path: /etc/login.defs
     regexp: '^SHA_CRYPT_MIN_ROUNDS[\s]*[0-9]*$'
-    line: 'SHA_CRYPT_MIN_ROUNDS   5000'
+    line: 'SHA_CRYPT_MIN_ROUNDS   10000'
+
+- name: "Set maximum number of password hash rounds"
+  lineinfile:
+    path: /etc/login.defs
+    regexp: '^SHA_CRYPT_MAX_ROUNDS[\s]*[0-9]*$'
+    line: 'SHA_CRYPT_MAX_ROUNDS   10000'
 
 #
 # Linux Failed password attempts
@@ -224,6 +230,14 @@
   when:
     - item.stat.exists == true
 
+- name: Limit access to the assembler binary
+  file:
+    path: "/usr/bin/as"
+    state: file
+    mode: "0700"
+    owner: root
+    group: root
+
 #
 # Disable direct root login
 #
@@ -267,8 +281,7 @@
     state: absent
     regexp: '^tcp6.*'
 
-- name: Disable automatic ipv6 configuration
-  when: ansible_default_ipv6|length > 0
+- name: Disable automatic ipv6 configuration and routing
   sysctl:
     name: "{{ item.name }}"
     value: "{{ item.value }}"
@@ -276,12 +289,13 @@
     reload: yes
   with_items:
     - { name: 'net.ipv6.conf.all.accept_source_route', value: 0 }
+    - { name: 'net.ipv6.conf.default.accept_source_route', value: 0 }
     - { name: 'net.ipv6.conf.all.accept_ra', value: 0 }
     - { name: 'net.ipv6.conf.default.accept_ra', value: 0 }
     - { name: 'net.ipv6.conf.all.accept_redirects', value: 0 }
     - { name: 'net.ipv6.conf.default.accept_redirects', value: 0 }
-    - { name: 'net.ipv6.conf.default.accept_source_route', value: 0 }
     - { name: 'net.ipv6.conf.all.forwarding', value: 0 }
+    - { name: 'net.ipv6.conf.default.forwarding', value: 0 }
 
 #
 # Configure kernel parameters
@@ -312,6 +326,8 @@
     - { name: 'kernel.randomize_va_space', value: 2 }
     - { name: 'kernel.core_pattern', value: '/var/core/core'}
     - { name: 'kernel.kptr_restrict', value: 2 }
+    - { name: 'kernel.sysrq', value: 0 }
+    - { name: 'kernel.yama.ptrace_scope', value: 3 }
 
 #
 # Configure core dump
@@ -330,6 +346,13 @@
     line: 'Storage=none'
 
 #
+# Confingure kernel dump
+- name: "Disable kernel dump service"
+  shell: systemctl stop kdump.service
+
+- name: "Disable kernel dump service"
+  shell: systemctl disable kdump.service
+
 # Configure syslog
 #
 - name: "Stop rsyslog Service"