mrwho/ansible-bootstrap-rocky9
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add python3-firewall

Browse source
This commit is contained in:
mrwho 2026-07-10 12:52:37 +03:00
parent 771df03e09
commit 1cff05f44f
3 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
inventory/prod/hosts.yml
View file

@ -29,8 +29,8 @@ all:
ansible_host: git.local.mrwho.ru ansible_host: git.local.mrwho.ru
vm03: vm03:
ansible_host: 150.251.147.212 ansible_host: 150.251.147.212
ansible_ssh_user: root # ansible_ssh_user: root
ansible_ssh_password: OdUdPx7yKa4Ga1i # ansible_ssh_password: OdUdPx7yKa4Ga1i
# rocky9-template: # rocky9-template:
# ansible_host: 172.20.21.106 # ansible_host: 172.20.21.106

4
playbooks/rocky9.yml
View file

@ -29,7 +29,7 @@
openssh_permit_root_login: "no" # Completely disable root SSH openssh_permit_root_login: "no" # Completely disable root SSH
openssh_challenge_response_auth: false openssh_challenge_response_auth: false
# Rate limiting and attack mitigation (OpenSSH 9.8+) # Rate limiting and attack mitigation (OpenSSH 9.8+)
openssh_enable_persourcepenalties: true openssh_enable_persourcepenalties: false
openssh_persource_authfail_penalty: "10s" # Aggressive penalty openssh_persource_authfail_penalty: "10s" # Aggressive penalty
openssh_persource_maxstartups: "5:30:10" # Very restrictive openssh_persource_maxstartups: "5:30:10" # Very restrictive
# Disable all port forwarding # Disable all port forwarding
@ -44,7 +44,7 @@
openssh_macs: openssh_macs:
- hmac-sha2-512-etm@openssh.com - hmac-sha2-512-etm@openssh.com
# Minimum RSA key size # Minimum RSA key size
openssh_required_rsa_size: 4096 # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement) openssh_required_rsa_size: 2048 # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
# Aggressive session limits # Aggressive session limits
openssh_max_auth_tries: 2 # (Exceeds PCI DSS 8.3.6 limit of 6) openssh_max_auth_tries: 2 # (Exceeds PCI DSS 8.3.6 limit of 6)
openssh_login_grace_time: "20s" openssh_login_grace_time: "20s"

1
roles/rocky9/tasks/install_packages.yml
View file

@ -70,6 +70,7 @@
- qemu-guest-agent - qemu-guest-agent
- cloud-utils-growpart - cloud-utils-growpart
- iptraf-ng - iptraf-ng
- python3-firewall
# - speedtest-cli # - speedtest-cli
# - deltarpm # - deltarpm
# - screen # - screen