freedomofpress/securedrop — pull request #697 by dolanjs (2014-10-26 00:46:21+00:00)
Title: Boot into grsec first

Encountered multiple issues with running the playbook across the host in parallel.
Did not change more of the actual tasks but did need to move what role and how they were grouped to achieve the correct order events that would work across the environments.

Current layout is:
ALL:
common
- set_etc_hosts
- create_users
- sysctl
- harden_dns
- remove_kernel_headers
- install_tor
- add fpf repo
- install grsec
- unattended_upgrades
- apply_grsec_lock

--------------------
Mon:
Till modified the common-app role will have to run separately since the way the task are written they don't work for both severs, once fixed they can be moved to the common role

common-mon
- configure_tor_instances
- display_onions
- install_local_pkgs

install_local_pkg

OSSEC_server
- install osssec-server pkg (use to be called mon_install_fpf_deb_pkgs)
- place ossec.config in place after installing
- configure_ossec_gpg_alerts
- configure_postfix_for_ossec
- authd
(if firewall exemptions are needed apply them)

-----------------------
App:
Till modified the common-app role will have to run separately since the way the task are written they don't work for both severs, once fixed they can be moved to the common role

common-app
- configure_tor_instances
- display_onions
- install_local_pkgs

install_local_pkg

OSSEC_agent

- agent_auth
(if firewall exmeption are needed apply them)
(restart agent at the end)

app
- install_harden_apache

securedrop
- create_app_dirs
- initialize_securedrop

app-test

(until these task are re-written they will need to be ran separately on each host)
restrict_direct_access_app:
- ssh
- iptables
- handler for ssh

allow_direct_access
- ssh
- web
- handler for ssh and iptables

- handler for ssh
- handler for iptables

-----------------------

Monitor:

remove_authd_role

(until these task are re-written they will need to be ran separately on each host)
restrict_direct_access_mon:
- ssh
- iptables
- handler for ssh

allow_direct_access
- ssh
- handler for ssh
- handler for iptables

---------------------
Prod/Demo hosts:

reboot (to apply iptables rules will only be available over tor after this point for prod/demo instances)