Merge branches 'YH-750', 'YH-752' and 'YH-753' into release-1.23.0

ansible/cluster-dbserver.yml

@@ -19,4 +19,7 @@
     - nfs_server
     - postfix
     - clamav
+  handlers:
+    - name: restart sshd
+      service: name=ssh state=restarted
 

ansible/cluster-webserver.yml

@@ -19,3 +19,6 @@
     - ckan
     - drupal
     - data
+  handlers:
+    - name: restart sshd
+      service: name=ssh state=restarted

ansible/roles/common/tasks/main.yml

@@ -65,6 +65,16 @@
   - non-local
   - common
 
+- name: sshd configuration file update
+  template: src=sshd_config.j2 dest="/etc/ssh/sshd_config" 
+    mode=0644 owner=root group=root
+    backup=yes validate='/usr/sbin/sshd -T -f %s'
+  tags:
+  - non-local
+  - common
+  notify:
+  - restart sshd
+
 - name: Ensure ansible requirements
   action: apt pkg="{{ item }}" state=latest
   with_items:

ansible/roles/common/templates/sshd_config.j2

@@ -0,0 +1,94 @@
+# Package generated configuration file
+# See the sshd_config(5) manpage for details
+
+# What ports, IPs and protocols we listen for
+Port 22
+# Use these options to restrict which interfaces/protocols sshd will bind to
+#ListenAddress ::
+#ListenAddress 0.0.0.0
+Protocol 2
+# HostKeys for protocol version 2
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 768
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin no
+StrictModes yes
+MaxAuthTries 4
+
+# Set Idle Timeout Interval for User Login
+ClientAliveInterval 300
+ClientAliveCountMax 0
+
+RSAAuthentication yes
+PubkeyAuthentication yes
+#AuthorizedKeysFile     %h/.ssh/authorized_keys
+
+# Do Not Allow Users to Set Environment Options
+PermitUserEnvironment no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts yes
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication no
+# similar for protocol version 2
+HostbasedAuthentication no
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Change to no to disable tunnelled clear text passwords
+PasswordAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosGetAFSToken no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+X11Forwarding no
+X11DisplayOffset 10
+PrintMotd no
+PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem sftp /usr/lib/openssh/sftp-server
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes

ansible/roles/nginx/templates/nginx.conf.j2

@@ -13,7 +13,9 @@ http {
     tcp_nodelay on;
     keepalive_timeout 65;
     types_hash_max_size 2048;
-    # server_tokens off;
+
+    # Don't send server information headers
+    server_tokens off;
 
     # Need for long hostnames (such as in AWS)
     server_names_hash_bucket_size 128;
@@ -33,4 +35,7 @@ http {
 
     include /etc/nginx/conf.d/*.conf;
     include /etc/nginx/sites-enabled/*;
+
+    # Always enforce same origin policy
+    add_header X-Frame-Options SAMEORIGIN;
 }

ansible/single-server.yml

@@ -30,3 +30,6 @@
     - drupal
     - clamav
     - data
+  handlers:
+    - name: restart sshd
+      service: name=ssh state=restarted