Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add conditions for various tasks. Fix #15 #16

Merged
merged 1 commit into from
Jun 3, 2015
Merged

Add conditions for various tasks. Fix #15 #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions roles/ansible-os-hardening/tasks/sysctl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,15 @@
---
- name: Disable IPv4 traffic forwarding.
sysctl: name='net.ipv4.ip_forward' value=0 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: not os_network_forwarding

- name: Enable IPv4 traffic forwarding again, but only if required.
sysctl: name='net.ipv4.ip_forward' value=1 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: os_network_forwarding

- name: Disable IPv6 traffic forwarding.
sysctl: name='net.ipv6.conf.all.forwarding' value=0 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: not (os_network_forwarding and os_network_ipv6_enable)

- name: Enable IPv6 traffic forwarding again, but only if required.
sysctl: name='net.ipv6.conf.all.forwarding' value=1 sysctl_set=yes state=present reload=yes ignoreerrors=yes
Expand Down Expand Up @@ -37,10 +39,11 @@
- name: Adjust the ICMP ratelimit to include ping, dst unreachable, source quench, ime exceed, param problem, timestamp reply, information reply
sysctl: name='net.ipv4.icmp_ratemask' value=88089 sysctl_set=yes state=present reload=yes ignoreerrors=yes

- name: Disable or Enable IPv6 as it is needed.
- name: Disable IPv6
sysctl: name='net.ipv6.conf.all.disable_ipv6' value=1 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: not os_network_ipv6_enable

- name: Disable or Enable IPv6 as it is needed.
- name: Enable IPv6 as it is needed.
sysctl: name='net.ipv6.conf.all.disable_ipv6' value=0 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: os_network_ipv6_enable

Expand All @@ -49,13 +52,15 @@

- name: Define restriction level for announcing the local source IP
sysctl: name='net.ipv4.conf.all.arp_ignore' value=0 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: not os_network_arp_restricted

- name: Define restriction level for announcing the local source IP
sysctl: name='net.ipv4.conf.all.arp_ignore' value=1 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: os_network_arp_restricted

- name: Define mode for sending replies in response to received ARP requests that resolve local target IP addresses
sysctl: name='net.ipv4.conf.all.arp_announce' value=0 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: not os_network_arp_restricted

- name: Define mode for sending replies in response to received ARP requests that resolve local target IP addresses
sysctl: name='net.ipv4.conf.all.arp_announce' value=2 sysctl_set=yes state=present reload=yes ignoreerrors=yes
Expand Down Expand Up @@ -127,6 +132,7 @@
# * **128** - reboot/poweroff
# * **256** - nicing of all RT tasks
- sysctl: name='kernel.sysrq' value=0 sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: not os_security_kernel_enable_sysrq

- sysctl: name='kernel.sysrq' value='{{ os_security_kernel_secure_sysrq }}' sysctl_set=yes state=present reload=yes ignoreerrors=yes
when: os_security_kernel_enable_sysrq
Expand Down