wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-09-06 12:03:38 +02:00
Code Issues Projects Releases Wiki Activity

HardenedBSD

Browse source 
update-users BSD
This commit is contained in:
Jack Ivanov 2017-02-26 12:06:59 +03:00
parent d090bf9664
commit 12536e76e9
5 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/FreeBSD.md
View file

@ -1,4 +1,4 @@
# FreeBSD # FreeBSD / HardenedBSD
It is only possible to install Algo on existing systems only in order to avoid recompiling the kernel while deploying It is only possible to install Algo on existing systems only in order to avoid recompiling the kernel while deploying

6
playbooks/freebsd.yml
View file

@ -1,9 +1,9 @@
--- ---
- name: FreeBSD | Install prerequisites - name: FreeBSD / HardenedBSD | Install prerequisites
raw: sleep 10 && sudo pkg install -y python27 raw: sleep 10 && env ASSUME_ALWAYS_YES=YES sudo pkg install -y python27
- name: FreeBSD | Configure defaults - name: FreeBSD / HardenedBSD | Configure defaults
raw: sudo ln -sf /usr/local/bin/python2.7 /usr/bin/python2.7 raw: sudo ln -sf /usr/local/bin/python2.7 /usr/bin/python2.7
- include: facts/FreeBSD.yml - include: facts/FreeBSD.yml

2
roles/dns_adblocking/tasks/freebsd.yml
View file

@ -1,4 +1,4 @@
--- ---
- name: FreeBSD | Enable dnsmasq - name: FreeBSD / HardenedBSD | Enable dnsmasq
lineinfile: dest=/etc/rc.conf regexp=^dnsmasq_enable= line='dnsmasq_enable="YES"' lineinfile: dest=/etc/rc.conf regexp=^dnsmasq_enable= line='dnsmasq_enable="YES"'

2
roles/vpn/tasks/freebsd.yml
View file

@ -1,4 +1,4 @@
--- ---
- name: FreeBSD | Enable strongswan - name: FreeBSD / HardenedBSD | Enable strongswan
lineinfile: dest=/etc/rc.conf regexp=^strongswan_enable= line='strongswan_enable="YES"' lineinfile: dest=/etc/rc.conf regexp=^strongswan_enable= line='strongswan_enable="YES"'

5
users.yml
View file

@ -36,6 +36,9 @@
- config.cfg - config.cfg
pre_tasks: pre_tasks:
- name: Common pre-tasks
include: playbooks/common.yml
- set_fact: - set_fact:
IP_subject_alt_name: "{{ IP_subject }}" IP_subject_alt_name: "{{ IP_subject }}"
easyrsa_p12_export_password: "{{ p12_export_password|default((ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0]) }}" easyrsa_p12_export_password: "{{ p12_export_password|default((ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0]) }}"
@ -117,7 +120,7 @@
- name: Copy the revoked certificates to the vpn server - name: Copy the revoked certificates to the vpn server
copy: copy:
src: configs/{{ IP_subject_alt_name }}/pki/crl/{{ item }}.crt src: configs/{{ IP_subject_alt_name }}/pki/crl/{{ item }}.crt
dest: /etc/ipsec.d/crls/{{ item }}.crt dest: "{{ config_prefix|default('/') }}etc/ipsec.d/crls/{{ item }}.crt"
when: item not in users when: item not in users
with_items: "{{ valid_certs.stdout_lines }}" with_items: "{{ valid_certs.stdout_lines }}"
notify: notify: