· 8 years ago · Jan 17, 2018, 04:54 PM
1(.venv) amnesia@amnesia:~/Persistent/securedrop/install_files/ansible-base$ ansible-playbook securedrop-prod.yml --tags postfix,ossec -v --diff
2Using /home/amnesia/Persistent/securedrop/install_files/ansible-base/ansible.cfg as config file
3
4PLAY [Ensure validation is run before prod install] ************************************************************
5
6TASK [Gathering Facts] *****************************************************************************************
7ok: [localhost]
8
9TASK [validate : include] **************************************************************************************
10
11PLAY [Add FPF apt repository and install base packages.] *******************************************************
12
13TASK [Gathering Facts] *****************************************************************************************
14ok: [mon]
15ok: [app]
16
17PLAY [Configure OSSEC.] ****************************************************************************************
18
19TASK [Gathering Facts] *****************************************************************************************
20ok: [app]
21ok: [mon]
22
23TASK [ossec : Install securedrop-ossec-agent package.] *********************************************************
24ok: [app] => {"cache_update_time": 1515460495, "cache_updated": false, "changed": false}
25
26TASK [ossec : Install OSSEC manager package.] ******************************************************************
27ok: [mon] => {"cache_update_time": 1515460497, "cache_updated": false, "changed": false}
28
29TASK [ossec : Copy the OSSEC GPG public key for sending encrypted alerts.] *************************************
30
31ok: [mon] => {"changed": false, "checksum": "4b1b156639b8fbfb83a833132041bac64a82bae2", "dest": "/var/ossec/conor.asc", "gid": 0, "group": "root", "mode": "0644", "owner": "root", "path": "/var/ossec/conor.asc", "size": 20128, "state": "file", "uid": 0}
32
33TASK [ossec : Add the OSSEC GPG public key to the OSSEC manager keyring.] **************************************
34ok: [mon] => {"changed": false, "cmd": ["gpg", "--homedir", "/var/ossec/.gnupg", "--import", "/var/ossec/conor.asc"], "delta": "0:00:00.023228", "end": "2018-01-09 01:23:20.008262", "rc": 0, "start": "2018-01-09 01:23:19.985034", "stderr": "gpg: key F9A1A94D: \"Conor Schaefer <conor@freedom.press>\" not changed\ngpg: Total number processed: 1\ngpg: unchanged: 1", "stderr_lines": ["gpg: key F9A1A94D: \"Conor Schaefer <conor@freedom.press>\" not changed", "gpg: Total number processed: 1", "gpg: unchanged: 1"], "stdout": "", "stdout_lines": []}
35
36TASK [ossec : Copy script for sending GPG-encrypted OSSEC alerts.] *********************************************
37ok: [mon] => {"changed": false, "gid": 998, "group": "ossec", "mode": "0550", "owner": "root", "path": "/var/ossec/send_encrypted_alarm.sh", "size": 2125, "state": "file", "uid": 0}
38
39TASK [ossec : Create OSSEC manager SSL key.] *******************************************************************
40ok: [mon] => {"changed": false, "cmd": "openssl genrsa -out /var/ossec/etc/sslmanager.key 4096", "rc": 0, "stdout": "skipped, since /var/ossec/etc/sslmanager.key exists", "stdout_lines": ["skipped, since /var/ossec/etc/sslmanager.key exists"]}
41
42TASK [ossec : Create OSSEC manager SSL certificate.] ***********************************************************
43ok: [mon] => {"changed": false, "cmd": "openssl req -new -x509 -batch -subj \"/CA=AU/ST=Some-State/locality=city/O=Internet Widgits Pty Ltd/commonName=mon/organizationUnitName=section/emailAddress=admin@localhost\" -key /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert -days 365", "rc": 0, "stdout": "skipped, since /var/ossec/etc/sslmanager.cert exists", "stdout_lines": ["skipped, since /var/ossec/etc/sslmanager.cert exists"]}
44
45TASK [ossec : Check whether Application Server is registered as OSSEC agent.] **********************************
46ok: [mon] => {"changed": false, "cmd": ["/var/ossec/bin/list_agents", "-a"], "delta": "0:00:00.007961", "end": "2018-01-09 01:23:56.939846", "rc": 0, "start": "2018-01-09 01:23:56.931885", "stderr": "", "stderr_lines": [], "stdout": "app-prod-10.0.1.4 is available.", "stdout_lines": ["app-prod-10.0.1.4 is available."]}
47
48TASK [ossec : Set host fact for OSSEC registration state.] *****************************************************
49ok: [app] => {"ansible_facts": {"ossec_agent_already_registered": true}, "changed": false}
50ok: [mon] => {"ansible_facts": {"ossec_agent_already_registered": true}, "changed": false}
51
52TASK [ossec : Start authd.] ************************************************************************************
53
54TASK [ossec : Add firewall exemption for OSSEC agent registration (both servers)] ******************************
55
56TASK [ossec : Register OSSEC agent.] ***************************************************************************
57
58TASK [ossec : Remove firewall exemption for OSSEC agent registration.] *****************************************
59ok: [mon] => (item={u'chain': u'INPUT', u'proto': u'tcp', u'cstate': u'NEW,ESTABLISHED,RELATED', u'jump': u'ACCEPT', u'source': u'app-prod', u'match': u'state', u'dest_port': 1515}) => {"chain": "INPUT", "changed": false, "failed": false, "flush": false, "ip_version": "ipv4", "item": {"chain": "INPUT", "cstate": "NEW,ESTABLISHED,RELATED", "dest_port": 1515, "jump": "ACCEPT", "match": "state", "proto": "tcp", "source": "app-prod"}, "rule": "-p tcp -s app-prod -m state -j ACCEPT --destination-port 1515 --state NEW,ESTABLISHED,RELATED", "state": "absent", "table": "filter"}
60ok: [app] => (item={u'chain': u'OUTPUT', u'proto': u'tcp', u'cstate': u'NEW,ESTABLISHED,RELATED', u'jump': u'ACCEPT', u'dest': u'10.0.1.5', u'match': u'state', u'dest_port': 1515}) => {"chain": "OUTPUT", "changed": false, "failed": false, "flush": false, "ip_version": "ipv4", "item": {"chain": "OUTPUT", "cstate": "NEW,ESTABLISHED,RELATED", "dest": "10.0.1.5", "dest_port": 1515, "jump": "ACCEPT", "match": "state", "proto": "tcp"}, "rule": "-p tcp -d 10.0.1.5 -m state -j ACCEPT --destination-port 1515 --state NEW,ESTABLISHED,RELATED", "state": "absent", "table": "filter"}
61ok: [mon] => (item={u'chain': u'OUTPUT', u'proto': u'tcp', u'cstate': u'ESTABLISHED,RELATED', u'jump': u'ACCEPT', u'dest': u'app-prod', u'source_port': 1515, u'match': u'state'}) => {"chain": "OUTPUT", "changed": false, "failed": false, "flush": false, "ip_version": "ipv4", "item": {"chain": "OUTPUT", "cstate": "ESTABLISHED,RELATED", "dest": "app-prod", "jump": "ACCEPT", "match": "state", "proto": "tcp", "source_port": 1515}, "rule": "-p tcp -d app-prod -m state -j ACCEPT --source-port 1515 --state ESTABLISHED,RELATED", "state": "absent", "table": "filter"}
62ok: [app] => (item={u'chain': u'INPUT', u'proto': u'tcp', u'cstate': u'ESTABLISHED,RELATED', u'jump': u'ACCEPT', u'source': u'10.0.1.5', u'source_port': 1515, u'match': u'state'}) => {"chain": "INPUT", "changed": false, "failed": false, "flush": false, "ip_version": "ipv4", "item": {"chain": "INPUT", "cstate": "ESTABLISHED,RELATED", "jump": "ACCEPT", "match": "state", "proto": "tcp", "source": "10.0.1.5", "source_port": 1515}, "rule": "-p tcp -s 10.0.1.5 -m state -j ACCEPT --source-port 1515 --state ESTABLISHED,RELATED", "state": "absent", "table": "filter"}
63
64TASK [ossec : Check if authd process is running on Monitor Server.] ********************************************
65ok: [mon] => {"changed": false, "cmd": ["pgrep", "ossec-authd"], "delta": "0:00:00.007058", "end": "2018-01-09 01:24:16.376794", "failed": false, "failed_when_result": false, "rc": 1, "start": "2018-01-09 01:24:16.369736", "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}
66
67TASK [ossec : Kill authd process (if running) on Monitor Server.] **********************************************
68
69PLAY [Configure mailing utilities.] ****************************************************************************
70
71TASK [Gathering Facts] *****************************************************************************************
72ok: [mon]
73
74TASK [postfix : Install mailing utilities.] ********************************************************************
75ok: [mon] => (item=[u'procmail', u'postfix', u'mailutils']) => {"cache_update_time": 1515460497, "cache_updated": false, "changed": false, "item": ["procmail", "postfix", "mailutils"]}
76
77TASK [postfix : Copy postfix /etc/aliases file to route root mail alerts to OSSEC.] ****************************
78ok: [mon] => {"changed": false, "checksum": "d53c0d6e7431dba9e4d264b5594f1d36b7889257", "dest": "/etc/aliases", "gid": 0, "group": "root", "mode": "0644", "owner": "root", "path": "/etc/aliases", "size": 12, "state": "file", "uid": 0}
79
80TASK [postfix : Create mapping for outbound address.] **********************************************************
81ok: [mon] => {"changed": false, "checksum": "2902672553401d7ee8240697511319a3d635cb88", "dest": "/etc/postfix/generic", "gid": 0, "group": "root", "mode": "0644", "owner": "root", "path": "/etc/postfix/generic", "size": 38, "state": "file", "uid": 0}
82
83TASK [postfix : Configure SASL password for SMTP relay.] *******************************************************
84ok: [mon] => {"changed": false, "gid": 0, "group": "root", "mode": "0400", "owner": "root", "path": "/etc/postfix/sasl_passwd", "size": 96, "state": "file", "uid": 0}
85
86TASK [postfix : Configure Postfix to strip SMTP headers.] ******************************************************
87ok: [mon] => {"changed": false, "checksum": "1d0f4c2a0bb00355b5b2bc4f6fe72353486b1dc5", "dest": "/etc/postfix/header_checks", "gid": 0, "group": "root", "mode": "0644", "owner": "root", "path": "/etc/postfix/header_checks", "size": 131, "state": "file", "uid": 0}
88
89TASK [postfix : Copy Postfix config file.] *********************************************************************
90ok: [mon] => {"changed": false, "gid": 0, "group": "root", "mode": "0644", "owner": "root", "path": "/etc/postfix/main.cf", "size": 1605, "state": "file", "uid": 0}
91
92TASK [postfix : Configure Postfix service.] ********************************************************************
93ok: [mon] => {"changed": false, "enabled": true, "name": "postfix", "state": "started"}
94
95TASK [postfix : Create procmail log file.] *********************************************************************
96ok: [mon] => {"changed": false, "dest": "/var/log/procmail.log", "src": "/tmp/tmp5quP5W"}
97
98TASK [postfix : Update permissions on procmail log file.] ******************************************************
99ok: [mon] => {"changed": false, "gid": 0, "group": "root", "mode": "0660", "owner": "ossec", "path": "/var/log/procmail.log", "size": 0, "state": "file", "uid": 1001}
100
101TASK [postfix : Copy procmail config file.] ********************************************************************
102ok: [mon] => {"changed": false, "checksum": "24a72cb93d5530121006f87e654380c2adac015c", "dest": "/var/ossec/.procmailrc", "gid": 998, "group": "ossec", "mode": "0644", "owner": "root", "path": "/var/ossec/.procmailrc", "size": 162, "state": "file", "uid": 0}
103
104TASK [postfix : Create Postfix certificate directory (if using custom certificate).] ***************************
105
106TASK [postfix : Remove Postfix certificate directory (if not using custom certificate).] ***********************
107ok: [mon] => {"changed": false, "path": "/etc/ssl/certs_local", "state": "absent"}
108
109TASK [postfix : Copy custom Postfix certificate (if provided).] ************************************************
110
111PLAY [Configure SecureDrop Application Server.] ****************************************************************
112
113TASK [Gathering Facts] *****************************************************************************************
114ok: [app]
115
116PLAY [Lock down firewall configuration for Application and Monitor Servers.] ***********************************
117
118TASK [Gathering Facts] *****************************************************************************************
119ok: [mon]
120ok: [app]
121
122PLAY [Reboot Application and Monitor Servers.] *****************************************************************
123
124TASK [Gathering Facts] *****************************************************************************************
125ok: [mon]
126ok: [app]
127
128PLAY RECAP *****************************************************************************************************
129app : ok=8 changed=0 unreachable=0 failed=0
130localhost : ok=1 changed=0 unreachable=0 failed=0
131mon : ok=26 changed=0 unreachable=0 failed=0
132
133TASK: postfix : Configure SASL password for SMTP relay. ---------------- 23.59s
134TASK: ossec : Copy script for sending GPG-encrypted OSSEC alerts. ------ 20.69s
135TASK: postfix : Copy Postfix config file. ------------------------------ 19.85s
136TASK: Gathering Facts -------------------------------------------------- 17.07s
137TASK: ossec : Copy the OSSEC GPG public key for sending encrypted alerts. -- 14.78s
138TASK: ossec : Remove firewall exemption for OSSEC agent registration. -- 12.73s
139TASK: postfix : Copy procmail config file. ----------------------------- 12.08s
140TASK: postfix : Configure Postfix service. ----------------------------- 11.76s
141TASK: postfix : Create mapping for outbound address. -------------------- 9.66s
142TASK: postfix : Configure Postfix to strip SMTP headers. ---------------- 9.17s
143
144Playbook finished: Tue Jan 9 01:26:43 2018, 36 total tasks. 0:04:29 elapsed.