Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle sysctl VLANs #405

Merged
merged 6 commits into from
Dec 21, 2023
Merged

Handle sysctl VLANs #405

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7f9ed36
Replace "." with "/" for sysctl
Oct 3, 2023
c0d9a6c
quoted and add escape string for backslash
Dec 19, 2023
14d48ee
add test vm for vlan devices
Dec 19, 2023
aec6f31
Merge branch 'master' of github.com:sgnsys3/ansible-role-hardening
Dec 19, 2023
0e65f35
Merge pull request #2 from sgnsys3/master
sgnsys3 Dec 19, 2023
4200db3
fix Vagrantfile syntax
Dec 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 27 additions & 2 deletions Vagrantfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,32 @@ Vagrant.configure("2") do |config|
config.vbguest.installer_options = { allow_kernel_upgrade: true }
config.vm.provider "virtualbox" do |vb|
vb.customize ["modifyvm", :id, "--uart1", "0x3F8", "4"]
vb.customize ["modifyvm", :id, "--uartmode1", "file", File::NULL]
vb.customize ["modifyvm", :id, "--uartmode1", "disconnected"]
end

config.vm.define "bullseye_vlan" do |bullseye_vlan|
bullseye_vlan.vm.box = "debian/bullseye64"
bullseye_vlan.ssh.insert_key = true
bullseye_vlan.vm.hostname = "bullseye-vlan"
bullseye_vlan.vm.boot_timeout = 600
bullseye_vlan.vbguest.auto_update = false
bullseye_vlan.vm.provision "shell",
inline: "ip link set dev eth0 down; ip link set eth0 name eth0.101; ip link set dev eth0.101 up; dhclient -r eth0.101; dhclient eth0.101"
bullseye_vlan.vm.provision "shell",
inline: "apt-get update && apt-get -y install python3-pip && pip3 install ansible"
bullseye_vlan.vm.provision "ansible" do |a|
a.verbose = "v"
a.limit = "all"
a.playbook = "tests/test.yml"
a.extra_vars = {
"ansible_become_pass" => "vagrant",
"ansible_python_interpreter" => "/usr/bin/python3",
"sshd_admin_net" => ["0.0.0.0/0"],
"sshd_allow_groups" => ["vagrant", "sudo", "debian", "ubuntu"],
"system_upgrade" => "false",
"install_aide" => "false",
}
end
end

config.vm.define "bullseye" do |bullseye|
Expand All @@ -22,7 +47,7 @@ Vagrant.configure("2") do |config|
"ansible_python_interpreter" => "/usr/bin/python3",
"sshd_admin_net" => ["0.0.0.0/0"],
"sshd_allow_groups" => ["vagrant", "sudo", "debian", "ubuntu"],
"system_upgrade" => "no",
"system_upgrade" => "false",
}
end
end
Expand Down
11 changes: 11 additions & 0 deletions molecule/debian/molecule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,12 @@ provisioner:
log: true
inventory:
host_vars:
bullseye_vlan:
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need to add bullseye_vlan since no VLAN is actually configured

ansible_python_interpreter: /usr/bin/python3
sshd_admin_net: "0.0.0.0/0"
sshd_allow_groups: vagrant sudo
suid_sgid_permissions: false
system_upgrade: false
bookworm:
ansible_python_interpreter: /usr/bin/python3
sshd_admin_net:
Expand Down Expand Up @@ -50,6 +56,11 @@ platforms:
instance_raw_config_args:
- "vbguest.installer_options = { allow_kernel_upgrade: true }"
memory: 1024
- name: bullseye_vlan
box: debian/bullseye64
instance_raw_config_args:
- vbguest.auto_update = false
memory: 1024
- name: bullseye
box: debian/bullseye64
instance_raw_config_args:
Expand Down
2 changes: 1 addition & 1 deletion templates/etc/sysctl/sysctl.ipv6.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

### IPV6 related settings
{% if (system_has_ipv6 | bool) %}
net.ipv6.conf.{{ ansible_default_ipv4.interface }}.accept_ra_rtr_pref = {{ sysctl_dev_tty_ldisc_autoload | int }}
net.ipv6.conf.{{ ansible_default_ipv4.interface | regex_replace("\\.", "/") }}.accept_ra_rtr_pref = {{ sysctl_dev_tty_ldisc_autoload | int }}
{% for key, value in ipv6_sysctl_settings.items() %}
{{ key }} = {{ value }}
{% endfor %}
Expand Down