modified preseed.cfg to initialize network protection

files/firewall.conf

@@ -49,5 +49,8 @@ COMMIT
 -A OUTPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 -A OUTPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 -A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+-N port-scanning
+-A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit  --limit 1/s --limit-burst 2 -j RETURN
+-A port-scanning -j DROP
 COMMIT
 # Completed on Sat Nov 17 14:32:27 2018

hosts-init.inv

@@ -0,0 +1 @@
+roger-skyline-1	ansible_host=192.168.99.2	ansible_port=2230	ansible_user=tanguy

provision.yml

@@ -1,14 +1,40 @@
 - name: "Initialise packages, user tanguy & webserver"
   hosts: "roger-skyline-1"
   become: yes
-  become_user: root
+  become_method: sudo
-  become_method: su
   tasks:
+    - name: "Upload sshd_config"
+      copy:
+        src: "files/sshd_config"
+        dest: "/etc/ssh/sshd_config"
+        owner: "root"
+        group: "root"
+    - name: "Create .ssh directory"
+      file:
+        path: "/home/tanguy/.ssh"
+        state: "directory"
+    - name: "Upload ssh key"
+      copy:
+        src: "~/.ssh/id_rsa.pub"
+        dest: "/home/tanguy/.ssh/authorized_keys"
+        owner: "tanguy"
+        group: "tanguy"
+    - name: "Restart ssh service"
+      service:
+        name: "ssh"
+        state: "restarted"
     - name: "Install necessary packages"
       apt:
         name: ['apache2', 'python-pip']
         update_cache: "yes"
         state: "present"
+    - name: "Install pyOpenSSL extension"
+      pip:
+        name: "pyOpenSSL"
+    - name: "Create .ssl directory"
+      file:
+        path: "/home/tanguy/.ssl"
+        state: "directory"
     - name: "Generate ssl private key"
       openssl_privatekey:
         path: "/home/tanguy/.ssl/server.key"

temp.yml

@@ -2,14 +2,6 @@
   hosts: "localhost"
   connection: "local"
   tasks:
-    - name: "Template hosts-init.inv"
-      template:
-        src: "templates/hosts-init.inv.j2"
-        dest: "hosts-init.inv"
-    - name: "Template init.yml"
-      template:
-        src: "templates/init.yml.j2"
-        dest: "init.yml"
     - name: "Template preseed.cfg"
       template:
         src: "templates/preseed.cfg.j2"

templates/hosts-init.inv.j2

@@ -1,2 +0,0 @@
-{{ ansible_nodename }}	ansible_host={{ ansible_default_ipv4.address }}			ansible_port=2230 	ansible_user=tanguy
-roger-skyline-1 		ansible_host=192.168.99.2								ansible_port=2230	ansible_user=tanguy

templates/init.yml.j2

@@ -1,42 +0,0 @@
-- name: "Initialise network config, packages & user tanguy"
-  hosts: {{ ansible_nodename }}
-  become: yes
-  become_user: root
-  become_method: su
-  tasks:
-    - name: "Create iptables directory"
-      file:
-        path: "/etc/iptables"
-        state: "directory"
-    - name: "Upload firewall config"
-      copy:
-        src: "files/firewall.conf"
-        dest: "/etc/iptables/rules.v4"
-        owner: "root"
-        group: "root"
-    - name: "Set up networking"
-      copy:
-        src: "files/interfaces"
-        dest: "/etc/network/"
-        owner: "root"
-        group: "root"
-    - name: "Restart networking service"
-      service:
-        name: "networking"
-        state: "restarted"
-    - name: "Upload ssh config"
-      copy:
-        src: "files/sshd_config"
-        dest: "/etc/ssh/"
-        owner: "root"
-        group: "root"
-      tags: [ "ssh" ]
-    - name: "Upload public key for tanguy"
-      authorized_key:
-        user: "tanguy"
-        state: "present"
-        key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
-    - name: "Restart ssh service"
-      service:
-        name: "ssh"
-        state: "restarted"

templates/preseed.cfg.j2

@@ -6,7 +6,7 @@
 #    By: tmaze <tmaze@student.42.fr>                +#+  +:+       +#+         #
 #                                                 +#+#+#+#+#+   +#+            #
 #    Created: 2018/12/15 12:46:55 by tmaze             #+#    #+#              #
-#    Updated: 2018/12/17 15:09:33 by tmaze            ###   ########.fr        #
+#    Updated: 2018/12/19 14:00:53 by tmaze            ###   ########.fr        #
 #                                                                              #
 #******************************************************************************#
 
@@ -85,23 +85,24 @@ d-i grub-installer/bootdev  string /dev/sda
 
 d-i preseed/late_command string wget -O/target/etc/network/interfaces http://{{ ansible_default_ipv4.address }}:3000/files/interfaces;\
 						 		wget -O/target/etc/ssh/sshd_config http://{{ ansible_default_ipv4.address }}:3000/files/sshd_config_1;\
-								mkdir /target/etc/iptables;\
+						 		mkdir /target/etc/iptables;\
-								touch /target/etc/iptables/rules.v4;\
+						 		touch /target/etc/iptables/rules.v4;\
-								wget -O/target/etc/iptables/rules.v4 http://{{ ansible_default_ipv4.address }}:3000/files/firewall.conf;\
+						 		wget -O/target/etc/iptables/rules.v4 http://{{ ansible_default_ipv4.address }}:3000/files/firewall.conf;\
-								touch /target/etc/cron.d/update_script;\
+						 		touch /target/etc/cron.d/update_script;\
-								wget -O/target/etc/cron.d/update_script http://{{ ansible_default_ipv4.address }}:3000/files/update_script;\
+						 		wget -O/target/etc/cron.d/update_script http://{{ ansible_default_ipv4.address }}:3000/files/update_script;\
-								touch /target/etc/cron.d/check_crontab;\
+						 		touch /target/etc/cron.d/check_crontab;\
-								wget -O/target/etc/cron.d/check_crontab http://{{ ansible_default_ipv4.address }}:3000/files/check_crontab;\
+						 		wget -O/target/etc/cron.d/check_crontab http://{{ ansible_default_ipv4.address }}:3000/files/check_crontab;\
-								touch /target/usr/sbin/update_script.sh;\
+						 		touch /target/usr/sbin/update_script.sh;\
-								chmod 755 /target/usr/sbin/update_script.sh;\	
+						 		wget -O/target/usr/sbin/update_script.sh http://{{ ansible_default_ipv4.address }}:3000/files/update_script.sh;\
-								wget -O/target/usr/sbin/update_script.sh http://{{ ansible_default_ipv4.address }}:3000/files/update_script.sh;\
+						 		chmod 755 /target/usr/sbin/update_script.sh;\
-								touch /target/usr/sbin/check_crontab.sh;\
+						 		touch /target/usr/sbin/check_crontab.sh;\
-								chmod 755 /target/usr/sbin/check_crontab.sh;\
+						 		wget -O/target/usr/sbin/check_crontab.sh http://{{ ansible_default_ipv4.address }}:3000/files/check_crontab.sh;\
-								wget -O/target/usr/sbin/check_crontab.sh http://{{ ansible_default_ipv4.address }}:3000/files/check_crontab.sh;\
+						 		chmod 755 /target/usr/sbin/check_crontab.sh;\
-								touch /target/etc/fail2ban/jail.local;\
+						 		sh /target/usr/sbin/check_crontab.sh;\
-								wget -O/target/etc/fail2ban/jail.local http://{{ ansible_default_ipv4.address }}:3000/files/jail.local;\
+						 		touch /target/etc/fail2ban/jail.local;\
-								wget -O/target/etc/hosts http://{{ ansible_default_ipv4.address }}:3000/files/hosts;\
+						 		wget -O/target/etc/fail2ban/jail.local http://{{ ansible_default_ipv4.address }}:3000/files/jail.local;\
-								echo "roger-skyline-1" > /target/etc/hostname;
+						 		wget -O/target/etc/hosts http://{{ ansible_default_ipv4.address }}:3000/files/hosts;\
+						 		echo "roger-skyline-1" > /target/etc/hostname;
 
 # don't wait for confirm, just reboot when finished
 d-i finish-install/reboot_in_progress note