Forum libero

https://github.com/openstack/ansible-hardening

## APT Cache Options
# This variable is used across multiple OpenStack-Ansible roles to handle the
# apt cache updates as efficiently as possible.
cache_timeout: 600

# Set the package install state for distribution packages
# Options are 'present' and 'latest'
security_package_state: present

## EPEL
# Set the following variable to `no` to prevent the EPEL repository from being
# installed by the role. This may prevent certain packages from installing,
# such as ClamAV.
security_epel_install_repository: yes
#
# Some deployers install a customized EPEL package that redirects servers to
# their internal EPEL mirrors. Provide the name of the EPEL repository package
# (epel-release by default on CentOS) or a URL to an EPEL release RPM file.
security_epel_release_package: epel-release

###############################################################################
#  ____  _   _ _____ _       _____   ____ _____ ___ ____
# |  _ \| | | | ____| |     |___  | / ___|_   _|_ _/ ___|
# | |_) | |_| |  _| | |        / /  \___ \ | |  | | |  _
# |  _ <|  _  | |___| |___    / /    ___) || |  | | |_| |
# |_| \_\_| |_|_____|_____|  /_/    |____/ |_| |___\____|
#
# The following options are specific to the RHEL 7 STIG. For details on each
# option, refer to the ansible-hardening documentation:
#
#   https://docs.openstack.org/ansible-hardening/latest/domains.html
#
###############################################################################

## Accounts (accounts)
# Set minimum password lifetime to 1 day for interactive accounts.
security_set_minimum_password_lifetime: no                   # V-71927
security_set_maximum_password_lifetime: no                   # V-71931

## AIDE (aide)
# Initialize the AIDE database immediately (may take time).
security_rhel7_initialize_aide: no                           # V-71973

## Audit daemon (auditd)
# Send audit records to a different system using audisp.
#security_audisp_remote_server: '10.0.21.1'                  # V-72083
# Encrypt audit records when they are transmitted over the network.
#security_audisp_enable_krb5: yes                            # V-72085
# Set the auditd failure flag. WARNING: READ DOCUMENTATION BEFORE CHANGING!
security_rhel7_audit_failure_flag: 1                         # V-72081
# Set the action to take when the disk is full or network events cannot be sent.
security_rhel7_auditd_disk_full_action: syslog               # V-72087
security_rhel7_auditd_network_failure_action: syslog         # V-72087
# Size of remaining disk space (in MB) that triggers alerts.
security_rhel7_auditd_space_left: "{{ (ansible_mounts | selectattr('mount', 'equalto', '/') | map(attribute='size_total') | first * 0.25 / 1024 / 1024) | int }}" # V-72089
# Action to take when the space_left threshold is reached.
security_rhel7_auditd_space_left_action: email               # V-72091
# Send auditd email alerts to this user.
security_rhel7_auditd_action_mail_acct: root                 # V-72093
# Add audit rules for commands/syscalls.
security_rhel7_audit_chsh: yes                               # V-72167
security_rhel7_audit_chage: yes                              # V-72155
security_rhel7_audit_chcon: yes                              # V-72139
security_rhel7_audit_chmod: no                               # V-72105
security_rhel7_audit_chown: no                               # V-72097
security_rhel7_audit_creat: yes                              # V-72123
security_rhel7_audit_crontab: yes                            # V-72183
security_rhel7_audit_delete_module: yes                      # V-72189
security_rhel7_audit_fchmod: no                              # V-72107
security_rhel7_audit_fchmodat: no                            # V-72109
security_rhel7_audit_fchown: no                              # V-72099
security_rhel7_audit_fchownat: no                            # V-72103
security_rhel7_audit_fremovexattr: no                        # V-72119
security_rhel7_audit_fsetxattr: no                           # V-72113
security_rhel7_audit_ftruncate: yes                          # V-72133
security_rhel7_audit_init_module: yes                        # V-72187
security_rhel7_audit_gpasswd: yes                            # V-72153
security_rhel7_audit_lchown: no                              # V-72101
security_rhel7_audit_lremovexattr: no                        # V-72121
security_rhel7_audit_lsetxattr: no                           # V-72115
security_rhel7_audit_mount: yes                              # V-72171
security_rhel7_audit_newgrp: yes                             # V-72165
security_rhel7_audit_open: yes                               # V-72125
security_rhel7_audit_openat: yes                             # V-72127
security_rhel7_audit_open_by_handle_at: yes                  # V-72129
security_rhel7_audit_pam_timestamp_check: yes                # V-72185
security_rhel7_audit_passwd: yes                             # V-72149
security_rhel7_audit_postdrop: yes                           # V-72175
security_rhel7_audit_postqueue: yes                          # V-72177
security_rhel7_audit_pt_chown: yes                           # V-72181
security_rhel7_audit_removexattr: no                         # V-72117
security_rhel7_audit_rename: yes                             # V-72199
security_rhel7_audit_renameat: yes                           # V-72201
security_rhel7_audit_restorecon: yes                         # V-72141
security_rhel7_audit_rmdir: yes                              # V-72203
security_rhel7_audit_semanage: yes                           # V-72135
security_rhel7_audit_setsebool: yes                          # V-72137
security_rhel7_audit_setxattr: no                            # V-72111
security_rhel7_audit_ssh_keysign: yes                        # V-72179
security_rhel7_audit_su: yes                                 # V-72159
security_rhel7_audit_sudo: yes                               # V-72161
security_rhel7_audit_sudoedit: yes                           # V-72169
security_rhel7_audit_truncate: yes                           # V-72131
security_rhel7_audit_umount: yes                             # V-72173
security_rhel7_audit_unix_chkpwd: yes                        # V-72151
security_rhel7_audit_unlink: yes                             # V-72205
security_rhel7_audit_unlinkat: yes                           # V-72207
security_rhel7_audit_userhelper: yes                         # V-72157
# Add audit rules for other events.
security_rhel7_audit_account_access: yes                     # V-72143
security_rhel7_audit_sudo_config_changes: yes                # V-72163
security_rhel7_audit_insmod: yes                             # V-72191
security_rhel7_audit_rmmod: yes                              # V-72193
security_rhel7_audit_modprobe: yes                           # V-72195
security_rhel7_audit_account_actions: yes                    # V-72197

## Authentication (auth)
# Disallow logins from accounts with blank/null passwords via PAM.
security_disallow_blank_password_login: yes                  # V-71937
# Apply password quality rules.
# NOTE: The security_pwquality_apply_rules variable is a "master switch".
# Set the 'security_pwquality_apply_rules' variable to 'yes' to apply all of
# the password quality rules. Each rule can be disabled with a value of 'no'.
security_pwquality_apply_rules: no
security_pwquality_require_uppercase: yes                    # V-71903
security_pwquality_require_lowercase: yes                    # V-71905
security_pwquality_require_numeric: yes                      # V-71907
security_pwquality_require_special: yes                      # V-71909
security_pwquality_require_characters_changed: yes           # V-71911
security_pwquality_require_character_classes_changed: yes    # V-71913
security_pwquality_limit_repeated_characters: yes            # V-71915
security_pwquality_limit_repeated_character_classes: yes     # V-71917
security_pwquality_require_minimum_password_length: no       # V-71935
# Use pwquality when passwords are changed or established.
security_enable_pwquality_password_set: no                   # V-73159
# Ensure passwords are stored using SHA512.
security_password_encrypt_method: SHA512                     # V-71921
# Ensure user/group admin utilities only store encrypted passwords.
security_libuser_crypt_style_sha512: yes                     # V-71923
# Set a minimum/maximum lifetime limit for user passwords.
#security_password_min_lifetime_days: 1                      # V-71925
#security_password_max_lifetime_days: 60                     # V-71929
# Set a delay (in seconds) between failed login attempts.
security_shadow_utils_fail_delay: 4                          # V-71951
# Set a umask for all authenticated users.
# security_shadow_utils_umask: '077'                         # V-71995
# Create home directories for new users by default.
security_shadow_utils_create_home: yes                       # V-72013
# How many old user password to remember to prevent password re-use.
#security_password_remember_password: 5                      # V-71933
# Disable user accounts if the password expires.
security_disable_account_if_password_expires: no             # V-71941
# Lock user accounts with excessive login failures. See documentation.
security_pam_faillock_enable: no                             # V-71945 / V-71943 / RHEL-07-010373
security_pam_faillock_interval: 900
security_pam_faillock_attempts: 3
security_pam_faillock_deny_root: yes                         # RHEL-07-010373
security_pam_faillock_unlock_time: 604800                    # V-71943
# Limit the number of concurrent connections per account.
#security_rhel7_concurrent_session_limit: 10                 # V-72217
# Remove .shosts and shosts.equiv files.
security_rhel7_remove_shosts_files: no                       # V-72277

## File permissions (file_perms)
# Reset file permissions and ownership for files installed via RPM packages.
security_reset_perm_ownership: no                            # V-71849
# Search for files/directories owned by invalid users or groups.
security_search_for_invalid_owner: no                        # V-72007
security_search_for_invalid_group_owner: no                  # V-72009
# Set user/group owners on each home directory and set mode to 0750.
security_set_home_directory_permissions_and_owners: no       # V-72017 / V-72019 / V-72021

## Graphical interfaces (graphical)
# Disable automatic gdm logins
security_disable_gdm_automatic_login: yes                    # V-71953
# Disable timed gdm logins for guests
security_disable_gdm_timed_login: yes                        # V-71955
# Enable session locking for graphical logins.
security_lock_session: no                                    # V-71891
# Set a timer (in seconds) when an inactive session is locked.
security_lock_session_inactive_delay: 900                    # V-71893
# Prevent users from modifying session lock settings.
security_lock_session_override_user: yes                     # RHEL-07-010071
# Lock a session (start screensaver) when a session is inactive.
security_lock_session_when_inactive: yes                     # V-71893
# Time after screensaver starts when user login is required.
security_lock_session_screensaver_lock_delay: 5              # V-71901
# Enable a login banner and set the text for the banner.
security_enable_graphical_login_message: yes                 # V-71859
security_enable_graphical_login_message_text: >
    You are accessing a secured system and your actions will be logged along
    with identifying information. Disconnect immediately if you are not an
    authorized user of this system.
## Linux Security Module (lsm)
# Enable SELinux on Red Hat/CentOS and AppArmor on Ubuntu.
security_rhel7_enable_linux_security_module: yes             # V-71989 / V-71991

## Miscellaneous (misc)
# Disable the autofs service.
security_rhel7_disable_autofs: yes                           # V-71985
# Enable virus scanning with clamav
security_enable_virus_scanner: no                            # V-72213
# Run the virus scanner update during the deployment (if scanner is deployed)
security_run_virus_scanner_update: yes
# Disable ctrl-alt-delete key sequence on the console.
security_rhel7_disable_ctrl_alt_delete: yes                  # V-71993
# Install and enable firewalld for iptables management.
security_enable_firewalld: no                                # V-72273
# Rate limit TCP connections to 25/min and burstable to 100.
security_enable_firewalld_rate_limit: no                     # V-72271
security_enable_firewalld_rate_limit_per_minute: 25
security_enable_firewalld_rate_limit_burst: 100
# Require authentication in GRUB to boot into single-user or maintenance modes.
security_require_grub_authentication: no                     # V-71961 / V-71963
# The default password for grub authentication is 'secrete'.
security_grub_password_hash: grub.pbkdf2.sha512.10000.7B21785BEAFEE3AC71459D8210E3FB42EC0F5011C24A2DF31A8127D43A0BB4F1563549DF443791BE8EDA3AE4E4D4E04DB78D4CA35320E4C646CF38320CBE16EC.4B46176AAB1405D97BADB696377C29DE3B3266188D9C3D2E57F3AE851815CCBC16A275B0DBF6F79D738DAD8F598BEE64C73AE35F19A28C5D1E7C7D96FF8A739B
# Set session timeout.
security_rhel7_session_timeout: 600                          # V-72223
# Enable chrony for NTP time synchronization.
security_rhel7_enable_chrony: yes                            # V-72269
# Restrict mail relaying.
security_rhel7_restrict_mail_relaying: yes                   # V-72297
# Deploy a login banner.                                     # V-72225 / V-71863
security_login_banner_text: |
  ------------------------------------------------------------------------------
  * WARNING                                                                    *
  * You are accessing a secured system and your actions will be logged along   *
  * with identifying information. Disconnect immediately if you are not an     *
  * authorized user of this system.                                            *
  ------------------------------------------------------------------------------


## Packages (packages)
# Remove packages from the system as required by the STIG. Set any of these
# to 'no' to skip their removal.
security_rhel7_remove_rsh_server: yes                        # V-71967
security_rhel7_remove_telnet_server: yes                     # V-72077
security_rhel7_remove_tftp_server: yes                       # V-72301
security_rhel7_remove_xorg: yes                              # V-72307
security_rhel7_remove_ypserv: yes                            # V-71969
# Automatically remove dependencies when removing packages.
security_package_clean_on_remove: no                         # V-71987
# Automatically update packages.
security_rhel7_automatic_package_updates: no                 # V-71999
# Install packages for multi-factor authentication.
security_install_multifactor_auth_packages: yes              # V-72417

## RPM (rpm)
# Enable GPG checks for packages and repository data.
security_enable_gpgcheck_packages: yes                       # V-71977
security_enable_gpgcheck_packages_local: yes                 # V-71979
security_enable_gpgcheck_repo: no                            # V-71981

## ssh server (sshd)
# Ensure sshd is running and enabled at boot time.
security_enable_sshd: yes                                    # V-72235
# Disallow logins from users with empty/null passwords.
security_sshd_disallow_empty_password: yes                   # V-71939 / RHEL-07-010440
# Disallow users from overriding the ssh environment variables.
security_sshd_disallow_environment_override: yes             # V-71957
# Disallow host based authentication.
security_sshd_disallow_host_based_auth: yes                  # V-71959
# Set a list of allowed ssh ciphers.
security_sshd_cipher_list: 'aes128-ctr,aes192-ctr,aes256-ctr' # V-72221
# Specify a text file to be displayed as the banner/MOTD for all sessions.
security_sshd_banner_file: /etc/motd                         # V-71861 / V-72225
# Set the interval for max session length and the number of intervals to allow.
security_sshd_client_alive_interval: 600                     # V-72237
security_sshd_client_alive_count_max: 0                      # V-72241
# Print the last login for a user when they log in over ssh.
security_sshd_print_last_log: yes                            # V-72245
# Permit direct root logins
security_sshd_permit_root_login: no                          # V-72247
# Disallow authentication using known hosts authentication.
security_sshd_disallow_known_hosts_auth: yes                 # V-72249 / V-72239
# Disallow rhosts authentication.
security_sshd_disallow_rhosts_auth: yes                      # V-72243
# Enable X11 forwarding.
security_sshd_enable_x11_forwarding: yes                     # V-72303
# Set the allowed ssh protocols.
security_sshd_protocol: 2                                    # V-72251
# Set the list of allowed Message Authentication Codes (MACs) for ssh.
security_sshd_allowed_macs: 'hmac-sha2-256,hmac-sha2-512'    # V-72253
# Disallow Generic Security Service Application Program Interface (GSSAPI) auth.
security_sshd_disallow_gssapi: yes                           # V-72259
# Disallow compression or delay after login.
security_sshd_compression: 'delayed'                         # V-72267
# Require privilege separation at every opportunity.
security_sshd_enable_privilege_separation: yes               # V-72265
# Require strict mode checking of home directory configuration files.
security_sshd_enable_strict_modes: yes                       # V-72263
# Disallow Kerberos authentication.
security_sshd_disable_kerberos_auth: yes                     # V-72261

## Kernel settings (kernel)
# Disallow forwarding IPv4/IPv6 source routed packets on all interfaces
# immediately and by default on new interfaces.
security_disallow_source_routed_packet_forward_ipv4: yes     # V-72283 / V-72285
security_disallow_source_routed_packet_forward_ipv6: yes     # V-72319
# Disallow responses to IPv4 ICMP echoes sent to broadcast address.
security_disallow_echoes_broadcast_address: yes              # V-72287
# Disallow IPV4 ICMP redirects on all interfaces immediately and by default on
# new interfaces.
security_disallow_icmp_redirects: yes                        # V-73175 / V-72289 / V-72291 / V-72293
# Disallow IP forwarding.
security_disallow_ip_forwarding: no                          # V-72309
# Disable USB storage support.
security_rhel7_disable_usb_storage: yes                      # V-71983
# Disable kdump.
security_disable_kdump: yes                                  # V-72057


###############################################################################
#   ____  _   _ _____ _        __     ____ _____ ___ ____
#  |  _ \| | | | ____| |      / /_   / ___|_   _|_ _/ ___|
#  | |_) | |_| |  _| | |     | '_ \  \___ \ | |  | | |  _
#  |  _ <|  _  | |___| |___  | (_) |  ___) || |  | | |_| |
#  |_| \_\_| |_|_____|_____|  \___/  |____/ |_| |___\____|
#
#  DEPRECATED! The RHEL 6 STIG content and its tasks were deprecated in the
#  Ocata release and will be removed in a future release.
#
#  These configuration options apply to the RHEL 6 STIG content. Be sure to set
#  `stig_version` to `rhel6` to use the tasks for the RHEL 6 STIG content.
#
###############################################################################

## AIDE
# The default Ubuntu configuration for AIDE will cause it to wander into some
# terrible places on the system, such as /var/lib/lxc and images in /opt.
# The following three default exclusions are highly recommended for AIDE to
# work properly, but additional exclusions can be added to this list if needed.
security_aide_exclude_dirs:
  - /openstack
  - /opt
  - /run
  - /var
#
# By default, the AIDE database won't be initialized immediately since it can
# consume plenty of CPU and I/O resources while it runs. To initialize the
# AIDE database immediately when the playbook finishes, set the following
# variable to 'true':
security_initialize_aide: false

## Audit daemon
# V-38438 requires that auditd is enabled at boot time with a parameter in the
# GRUB configuration.
#
# If 'security_enable_audit_during_boot' is set to 'yes', then the 'audit=1'
# parameter will be added in /etc/default/grub.d/.
# If 'security_enable_grub_update is set to 'yes', the grub.cfg will be
# updated automatically.
security_enable_audit_during_boot: yes            # V-38438
security_enable_grub_update: yes                  # V-38438

# The following booleans control the rule sets added to auditd's default
# set of auditing rules.  To see which rules will be added for each boolean,
# refer to the templates/osas-auditd.j2 file.
#
# If the template changes due to booleans being adjusted, the new template
# will be deployed onto the host and auditd will get the new rules loaded
# automatically with augenrules.
#
security_audit_account_modification: yes          # V-38531, V-38534, V-38538
security_audit_change_localtime: yes              # V-38530
security_audit_change_system_time: yes            # V-38635
security_audit_clock_settime: yes                 # V-38527
security_audit_clock_settimeofday: yes            # V-38522
security_audit_clock_stime: yes                   # V-38525
security_audit_DAC_chmod: no                      # V-38543
security_audit_DAC_chown: no                      # V-38545
security_audit_DAC_lchown: no                     # V-38558
security_audit_DAC_fchmod: no                     # V-38547
security_audit_DAC_fchmodat: no                   # V-38550
security_audit_DAC_fchown: no                     # V-38552
security_audit_DAC_fchownat: no                   # V-38554
security_audit_DAC_fremovexattr: no               # V-38556
security_audit_DAC_lremovexattr: no               # V-38559
security_audit_DAC_fsetxattr: no                  # V-38557
security_audit_DAC_lsetxattr: no                  # V-38561
security_audit_DAC_setxattr: no                   # V-38565
security_audit_deletions: no                      # V-38575
security_audit_failed_access: no                  # V-38566
security_audit_filesystem_mounts: yes             # V-38568
security_audit_kernel_modules: yes                # V-38580
security_audit_mac_changes: yes                   # V-38541
security_audit_network_changes: yes               # V-38540
security_audit_sudoers: yes                       # V-38578
#
# **DANGER**
# Changing the options below can cause systems to go offline unexpectedly or
# stop serving requests as a security precaution. Read the developer notes for
# each STIG prior to adjusting the following variables.
# **DANGER**
#
# Set an action to occur when there is a disk error. Review the
# documentation for V-38464 before changing this option.
security_disk_error_action: SYSLOG                # V-38464
#
# Set an action to occur when the disk is full. Review the documentation for
# V-38468 before changing this option.
security_disk_full_action: SYSLOG                 # V-38468
#
# V-38678 - Set the amount of megabytes left when the space_left_action
# triggers. The STIG guideline doesn't specify a size, but Ubuntu chooses a
# default of 75MB, which is reasonable.
security_space_left: 75                           # V-38678
#
# Set an action to occur when the disk is approaching its capacity.
# Review the documentation for V-38470 before changing this option.
security_space_left_action: SYSLOG                # V-38470
#
# Set the maximum size of a rotated log file. Ubuntu's default
# matches the STIG requirement of 6MB.
security_max_log_file: 6                          # V 38633
#
# Sets the action to take when log files reach the maximum file size.
# Review the documentation for V-38634 before changing this option.
security_max_log_file_action: ROTATE              # V-38634
#
# Set the number of rotated audit logs to keep.  Ubuntu has 5 as the default
# and this matches the STIG's requirements.
security_num_logs: 5                              # V-38636
#
# Set the email address of someone who can receive and respond to notifications
# about low disk space for log volumes.
security_action_mail_acct: root                   # V-38680
#
# **IMMINENT DANGER**
# The STIG says that the system should switch to single user mode when the
# storage capacity gets very low. This can cause serious service disruptions
# and should only be set to 'single' for deployers in extremely high security
# environments. Ubuntu's default is SUSPEND, which will suspend logging.
# **IMMENENT DANGER**
security_admin_space_left_action: SUSPEND         # V-54381

## Chrony (NTP) configuration
# Install and enable chrony to sync time with NTP servers.
security_enable_chrony: yes                       # V-38620
# Adjust the following NTP servers if necessary.
security_ntp_servers:
  - 0.north-america.pool.ntp.org
  - 1.north-america.pool.ntp.org
  - 2.north-america.pool.ntp.org
  - 3.north-america.pool.ntp.org
# Chrony limits access to clients that are on certain subnets.  Adjust the
# following subnets here to limit client access to chrony servers.
security_allowed_ntp_subnets:
  - 10/8
  - 192.168/16
  - 172.16/12
# Listen for NTP requests only on local interfaces.
security_ntp_bind_local_interfaces_only: yes

## Core dumps
# V-38675 requires disabling core dumps for all users unless absolutely
# necessary. Set this variable to 'no' to skip this change.
security_disable_core_dumps: yes                  # V-38675

## Services
# The STIG recommends ensuring that some services are running if no services
# utilizing it are enabled.  Setting a boolean to 'yes' here will ensure that
# a service isn't actively running and will not be started after boot-up.
# Setting a 'no' will ensure that this Ansible role does not alter the service
# in any way from its current configuration.
#
security_disable_abrtd: yes                       # V-38641
security_disable_atd: yes                         # V-38640
security_disable_autofs: yes                      # V-38437
security_disable_avahi: yes                       # V-31618
security_disable_bluetooth: yes                   # V-38691
security_disable_netconsole: yes                  # v-38672
security_disable_qpidd: yes                       # V-38648
security_disable_rdisc: yes                       # V-38650
security_disable_rsh: yes                         # V-38594
security_disable_ypbind: yes                      # V-38604
security_disable_xinetd: yes                      # V-38582
#
# The STIG recommends ensuring that some services aren't installed at ANY time.
# Those services are listed here.  Setting a boolean here to 'yes' wiil
# ensure that the STIG is followed and the service is removed.  Setting a
# boolean to 'no' means that the playbook will not alter the service.
#
security_remove_ldap_server: yes                  # V-38627
security_remove_rsh_server: yes                   # V-38591
security_remove_sendmail: yes                     # V-38671
security_remove_telnet_server: yes                # V-38587
security_remove_tftp_server: yes                  # V-38606
security_remove_xinetd: yes                       # V-38584
security_remove_xorg: yes                         # v-38676
security_remove_ypserv: yes                       # V-38603
#
# The STIG does not allow the system to run a graphical interface. Set this
# variable to 'no' if you need a graphical interface on the server.
security_disable_x_windows: yes                   # V-38674

## SSH configuration
# The following configuration items will adjust how the ssh daemon is
# configured.  The recommendations from the RHEL 6 STIG are shown below, but
# they can be adjusted to fit a particular environment.
#
# Set a 15 minute time out for SSH sessions if there is no activity
security_ssh_client_alive_interval: 900           # V-38608
#
# Timeout ssh sessions as soon as ClientAliveInterval is reached once
security_ssh_client_alive_count_max: 0            # V-38610
#
# The ssh daemon must not permit root logins. The default value of 'yes' is a
# deviation from the STIG requirements due to how openstack-ansible operates,
# especially within OpenStack CI gate jobs. See documentation for V-38613 for
# more details.
security_ssh_permit_root_login: 'yes'             # V-38613

## Kernel
# Set these booleans to 'yes' to disable the kernel module (following the
# STIG requirements). Set the boolean to 'no' to ensure no changes are made.
security_disable_module_bluetooth: yes            # V-38682
security_disable_module_dccp: yes                 # V-38514
security_disable_module_rds: yes                  # V-38516
security_disable_module_sctp: yes                 # V-38515
security_disable_module_tipc: yes                 # V-38517
security_disable_module_usb_storage: no           # V-38490
security_disable_icmpv4_redirects: no             # V-38524
security_disable_icmpv4_redirects_secure: no      # V-38526
security_disable_icmpv6_redirects: no             # V-38548
#
# ** DANGER **
# It's strongly recommended to fully understand the effects of changing the
# following sysctl tunables. Refer to the documentation under 'Developer
# Notes' for each of the STIGs below before making any changes.
# ** DANGER **
#
security_sysctl_enable_tcp_syncookies: yes        # V-38539
security_sysctl_enable_martian_logging: no        # V-38528
#
# Deployers who wish to disable IPv6 entirely must set this configuration
# variable to 'yes'. See the documentation for V-38546 before making this
# change.
security_disable_ipv6: no                         # V-38546

# Sets the global challenge ACK counter to a large value such
# that a potential attacker could not reasonably come up against it.
security_set_tcp_challenge_ack_limit: yes    # CVE-2016-5696

## Mail
# The STIG requires inet_interfaces to be set to 'localhost', but Ubuntu will
# configure it to be 'all' when dpkg-reconfigure is unavailable (as it is when
# Ansible installs packages). The default here is 'localhost' to meet the STIG
# requirement, but some deployers may want this set to 'all' if their hosts
# need to receive emails over the network (which isn't common).
#
# See the documentation for V-38622 for more details.
security_postfix_inet_interfaces: localhost       # V-38622
#
# Configuring an email address here will cause hosts to forward the root user's
# email to another address.
#
#security_root_forward_email: user@example.com

## Linux Security Module (LSM)
# AppArmor and SELinux provide powerful security controls on a Linux system
# by setting policies for allowed actions. By setting the following variable
# to true, the appropriate LSM will be enabled for the Linux distribution:
#
#    Ubuntu: AppArmor
#    CentOS: SELinux
#
# See the ansible-hardening documentation for more details.
security_enable_linux_security_module: yes        # V-51337

## PAM and authentication
# V-38497 requires that accounts with null passwords aren't allowed to
# authenticate via PAM. Ubuntu 14.04's default allows these logins -- see the
# documentation for V-38497 for more details. Set the variable below to 'yes'
# to remove 'nullok_secure' from the PAM configuration or set it to 'no' to
# leave the PAM configuration unaltered.
security_pam_remove_nullok: yes                   # V-38497
#
# V-38501 requires that failed login attempts must lock a user account using
# pam_faillock, but Ubuntu doesn't package that PAM module. Instead, fail2ban
# can be installed to lock out IP addresses with failed logins for 15 minutes.
# Set the variable below to 'yes' to install and configure fail2ban.
security_install_fail2ban: no                     # V-38501
#
# The STIG requires bans to last 15 minutes. Adjust the following variable
# to set the time an IP is banned by fail2ban (in seconds).
security_fail2ban_bantime: 900                    # V-38501

## Password complexity and aging
# V-38475 - There is no password length requirement by default in Ubuntu 14.04.
# To set a password length requirement, uncomment
# security_password_minimum_length below. The STIG recommendation is 14
# characters.
#security_password_minimum_length: 14             # V-38475
# V-38477 - There is no password change limitation set by default in Ubuntu. To
# set the minimum number of days between password changes, uncomment the
# security_password_minimum_days variable below.  The STIG recommendation is 1
# day.
#security_password_minimum_days: 1                # V-38477
# V-38479 - There is no age limit on password by default in Ubuntu. Uncomment
# line below to use the STIG recommendation of 60 days.
#security_password_maximum_days: 60               # V-38479
# V-38480 - To warn users before their password expires, uncomment the line
# below and they will be warned 7 days prior (following the STIG).
#security_password_warn_age: 7                    # V-38480
# V-38684 - Setting the maximum number of simultaneous logins per user. The
# STIG sets a limit of 10.
#security_max_simultaneous_logins: 10             # V-38684
# V-38692 - Lock accounts that are inactive for 35 days.
#security_inactive_account_lock_days: 35          # V-38692

## sudo
# V-58901 requires that 'NOPASSWD' and '!authenticate' do not appear in any
# sudoers files since they could lead to a compromise. Set the following
# variables to 'yes' to comment out any lines found with these prohibited
# parameters or leave them set to 'no' (the default) to leave sudoers files
# unaltered. Deployers are urged to review the documentation for this STIG
# before making changes.
security_sudoers_remove_nopasswd: no              # V-58901
security_sudoers_remove_authenticate: no          # V-58901

## umask settings
# The STIG recommends changing various default umask settings for users and
# daemons via different methods. However, this could cause serious issues for
# production OpenStack environements which haven't been tested with these
# changes.
#
# The variables below are set to match the STIG requirements, but they are
# commented out to ensure they require deployers to opt-in for each change. To
# opt in for one of the changes below, simply uncomment the line and run the
# playbook. Deployers are strongly advised to review the documentation for
# these changes and review their systems to ensure these changes won't cause
# service disruptions.
#
# V-38642 - Set umask for daemons in init scripts to 027 or 022
#security_umask_daemons_init: 027                 # V-38642
#
# V-38645 - System default umask in /etc/login.defs must be 077
#security_umask_login_defs: 077                   # V-38645
#
# V-38649 - System default umask for csh must be 077
#security_umask_csh: 077                          # V-38649
#
# V-38651 - System default umask for bash must be 077
#security_umask_bash: 077                         # V-38651

## Unattended upgrades (APT) configuration
security_unattended_upgrades_enabled: false
security_unattended_upgrades_notifications: false

$ ls -la /var/run/php-fpm/
total 4
drwxr-xr-x  2 root  root  100 30 lug 18.29 .
drwxr-xr-x 24 root  root  580 30 lug 18.29 ..
srw-rw----  1 nginx nginx   0 30 lug 18.29 mediawiki.sock
-rw-r--r--  1 root  root    5 30 lug 18.29 php-fpm.pid
srw-rw----  1 nginx nginx   0 30 lug 18.29 wordpress.sock

   roles: 
    - common
    - hardening
    - mariadb
    - nginx
    - php-fpm
    - wordpress
    - mediawiki

cat /etc/php-fpm.d/wordpress.conf

[wordpress]
listen = /var/run/php-fpm/wordpress.sock
listen.owner = nginx
listen.group = nginx
listen.mode = 0660
user = wordpress
group = wordpress
pm = dynamic
pm.max_children = 10
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
pm.max_requests = 500
chdir = /srv/wordpress/
php_admin_value[open_basedir] = /srv/wordpress/:/tmp

- name: Disable default pool
  command: mv /etc/php-fpm.d/www.conf /etc/php-fpm.d/www.disabled creates=/etc/php-fpm.d/www.disabled
  notify: restart php-fpm
  tags: php-fpm

- name: Config php-fpm UNIX socket for wordpress.conf in php-fpm.d
  template: src=wordpress.conf dest=/etc/php-fpm.d/
  notify: restart php-fpm
  tags: php-fpm

[webserver@1024 ~]$ ls -la /var/run/php-fpm/
total 4
drwxr-xr-x  2 root  root   80 29 lug 01.11 .
drwxr-xr-x 24 root  root  580 30 lug 17.24 ..
-rw-r--r--  1 root  root    5 29 lug 01.11 php-fpm.pid
srw-rw----  1 nginx nginx   0 29 lug 01.11 wordpress.sock

---
- name: Download Mediawiki
  get_url: 
   url=https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.0.tar.gz 
   dest=/srv/
  tags: mediawiki

- name: Extract archive
  unarchive: 
   src=/srv/mediawiki-1.29.0.tar.gz 
   dest=/srv/mediawiki
   remote_src=True
  tags: mediawiki

- name: Add group "mediawiki"
  group: name=mediawiki
  tags: mediawiki

- name: Add user "mediawiki"
  user: name=mediawiki group=mediawiki home=/srv/mediawiki/
  tags: mediawiki

- name: Create MediaWiki database
  mysql_db: name={{ mw_db_name }} state=present login_password=
  tags: mediawiki

- name: Create Mediawiki database user
  mysql_user: 
   name={{ mw_db_user }} 
   password={{ mw_db_password }} 
   priv={{ mw_db_name }}.*:ALL 
   host='localhost' 
   login_password=
   state=present
  tags: mediawiki

- name: Change ownership of MediaWiki installation path
  file: path=/srv/mediawiki/ owner=mediawiki group=mediawiki state=directory recurse=yes
  tags: mediawiki

- name: Start php-fpm Service
  service: name=php-fpm state=started enabled=yes
  tags: mediawiki

- name: Start NGINX Service
  service: name=nginx state=started enabled=yes
  tags: mediawiki

nginx.conf
conf.d/
       wordpress.conf
       mediawiki.conf

cat nginx.conf

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
# Hardening settings found on the internet
    server_tokens off;
# useless for now 
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

cat wordpress.conf
server {
        listen       {{ nginx_wordpress_port }};
        server_name  {{ server_hostname }};
        root /srv/wordpress/;
 
	client_max_body_size 64M;
 
	# Deny access to any files with a .php extension in the uploads directory
        location ~* /(?:uploads|files)/.*\.php$ {
                deny all;
        }
 
        location / {
                index index.php index.html index.htm;
                try_files $uri $uri/ /index.php?$args;
        }
 
        location ~* \.(gif|jpg|jpeg|png|css|js)$ {
                expires max;
        }
 
        location ~ \.php$ {
                try_files $uri =404;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_index index.php;
             fastcgi_pass  unix:/var/run/php-fpm/wordpress.sock;
                fastcgi_param   SCRIPT_FILENAME
                                $document_root$fastcgi_script_name;
                include       fastcgi_params;
        }
}

cat mediawiki.conf
server {
    listen      {{ nginx_mediawiki_port }};
    server_name {{ server_hostname }};
    root /srv/mediawiki;

    client_max_body_size 5m;
    client_body_timeout 60;

    location / {
        try_files $uri $uri/ @rewrite;
    }

    location @rewrite {
        rewrite ^/(.*)$ /index.php?title=$1&$args;
    }

    location ^~ /maintenance/ {
        return 403;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/phpfpm.sock;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        try_files $uri /index.php;
        expires max;
        log_not_found off;
    }

    location = /_.gif {
        expires max;
        empty_gif;
    }

    location ^~ /cache/ {
        deny all;
    }

    location /dumps {
        root /srv/mediawiki/local;
        autoindex on;
    }
}