blob: b15d9e0b8cb6c9354759ebcbace99bcfc750a97f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
- hosts: localhost
become: true
tasks:
- name: Create containers user
ansible.builtin.user:
name: containers
- name: Install systemd-container and podman
ansible.builtin.package:
name:
- systemd-container
- podman
state: present
- name: Confirm systemd-linger is set for containers user
ansible.builtin.stat:
path: "/var/lib/systemd/linger/containers"
register: linger
- name: Set systemd-linger for containers user (if necessary)
ansible.builtin.shell: "loginctl enable-linger containers"
when: not linger.stat.exists
- name: Unprivileged port block
block:
- name: Confirm port 80 and above is allowed for unprivileged use
ansible.builtin.shell: "sysctl net.ipv4.ip_unprivileged_port_start |grep 80"
rescue:
- name: Set sysctl parameter net.ipv4.ip_unprivileged_port_start=80
ansible.builtin.lineinfile:
path: "/etc/sysctl.conf"
regexp: "^net.ipv4.ip_unprivileged_port_start=80"
line: "net.ipv4.ip_unprivileged_port_start=80"
- name: Reload sysctl
ansible.builtin.shell: "sysctl -p /etc/sysctl.conf"
- name: Confirm port 80 and above is allowed for unprivileged use
ansible.builtin.shell: "sysctl net.ipv4.ip_unprivileged_port_start |grep 80"
tags:
- never
- unprivileged-ports
|
