Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
101 lines
2.9 KiB
YAML
Executable file
101 lines
2.9 KiB
YAML
Executable file
---
|
|
- name: Install unbound
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- unbound
|
|
state: present
|
|
|
|
- name: Create systemd override directory for unbound
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/unbound.service.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Fix unbound sd_notify failure (disable notify type)
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/unbound.service.d/override.conf
|
|
content: |
|
|
[Service]
|
|
Type=simple
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: unbound_override
|
|
|
|
- name: Reload systemd after override change
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when: unbound_override.changed
|
|
|
|
- name: Deploy blocklist RPZ zonefile
|
|
ansible.builtin.template:
|
|
src: blocklist.rpz.j2
|
|
dest: /etc/unbound/blocklist.rpz
|
|
mode: "644"
|
|
notify:
|
|
- Restart unbound
|
|
|
|
- name: Create Unbound config
|
|
ansible.builtin.template:
|
|
src: unbound.conf.j2
|
|
dest: /etc/unbound/unbound.conf
|
|
mode: "644"
|
|
notify:
|
|
- Restart unbound
|
|
|
|
- name: Enable and start Unbound
|
|
ansible.builtin.systemd:
|
|
name: unbound
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Permit traffic in default zone for dns service
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
service: dns
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
notify:
|
|
- Restart firewalld
|
|
|
|
# EL9's crypto-policy default KexAlgorithms omits the post-quantum
|
|
# sntrup761x25519-sha512@openssh.com (the binary supports it). This drop-in
|
|
# prepends it (^ = place at head of default set) so it is preferred,
|
|
# mitigating "store now, decrypt later" attacks. Validated before restart;
|
|
# reverted if sshd rejects it, so a broken config can never lock out SSH.
|
|
- name: Prefer post-quantum SSH key exchange
|
|
block:
|
|
- name: Install post-quantum SSH key-exchange drop-in
|
|
ansible.builtin.copy:
|
|
dest: /etc/ssh/sshd_config.d/10-postquantum.conf
|
|
content: |
|
|
# Managed by Ansible (roles/resolvers) - prefer post-quantum key exchange
|
|
KexAlgorithms ^sntrup761x25519-sha512@openssh.com
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
register: pq_sshd_dropin
|
|
|
|
- name: Validate sshd configuration
|
|
ansible.builtin.command:
|
|
changed_when: false
|
|
|
|
- name: Restart sshd to apply key-exchange change
|
|
ansible.builtin.systemd:
|
|
name: sshd
|
|
state: restarted
|
|
when: pq_sshd_dropin is changed
|
|
rescue:
|
|
- name: Revert post-quantum drop-in after failed validation
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/sshd_config.d/10-postquantum.conf
|
|
state: absent
|
|
- name: Fail because sshd rejected the post-quantum drop-in
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
sshd -t rejected the post-quantum KexAlgorithms drop-in; it has been
|
|
removed and sshd was not restarted. Existing config is untouched.
|