chore: update

hardening/playbook-apparmor-hardening.yml

@@ -24,7 +24,7 @@
 #   ansible-playbook hardening/playbook-apparmor-hardening.yml --limit pre-prod-uber
 
 - name: Durcissement AppArmor (CIS Ubuntu 24.04)
-  hosts: prod,pre-prod,bdd-redis-prod,replica-prod,infra,infra-runner,infra-utils,load-balancer
+  hosts: prod,pre-prod,bdd-redis-prod,replica-prod,infra,infra-runner,infra-utils,ota-uber,load-balancer
   become: true
   serial: 1
   any_errors_fatal: true
@@ -69,6 +69,11 @@
             cmd: aa-enforce /etc/apparmor.d/*
         changed_when: true
 
+      - name: Recharger apparmor (aa-enforce seul ne suffit pas toujours a faire prendre en compte le changement par le kernel)
+        ansible.builtin.systemd:
+            name: apparmor
+            state: reloaded
+
       - name: Verifier l'etat final (apparmor_status)
         ansible.builtin.command:
             cmd: apparmor_status

hardening/playbook-ssh-hardenning.yml

@@ -1,5 +1,5 @@
 - name: SSH HARDENNING
-  hosts: load-balancer
+  hosts: prod,pre-prod,replica-prod,infra,infra-runner,infra-utils,ota-uber,load-balancer,!backup-mln
   become: true
   gather_facts: true
   tasks:
@@ -24,7 +24,7 @@
 
       - name: Check si la paire de clé SSH existe
         ansible.builtin.stat:
-            path: "{{ playbook_dir }}/../../.ssh/{{ user_ssh }}"
+            path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
         delegate_to: localhost
         become: false
         register: ssh_key_check
@@ -32,7 +32,7 @@
 
       - name: Générer la paire de clés SSH localement
         community.crypto.openssh_keypair:
-            path: "{{ playbook_dir }}/../../.ssh/{{ user_ssh }}"
+            path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
             type: ed25519
         delegate_to: localhost
         become: false
@@ -43,18 +43,26 @@
       - ansible.posix.authorized_key:
           user: "{{ user_ssh }}"
           state: present
-          key: "{{ lookup('file', playbook_dir + '/../../.ssh/' + user_ssh + '.pub') }}"
+          key: "{{ lookup('file', playbook_dir + '/../.ssh/' + user_ssh + '.pub') }}"
 
       - name: Déployer la config sshd durcie
         ansible.builtin.template:
             src: ../templates/ssh_harden_conf.j2
             dest: /etc/ssh/sshd_config
-            mode: "0644"
+            mode: "0600"
             owner: root
             group: root
             validate: /usr/sbin/sshd -t -f %s
         notify: restart ssh
 
+      - name: Restreindre les permissions des cles d'hote SSH privees (CIS 5.1.2)
+        ansible.builtin.shell: chmod 0600 /etc/ssh/ssh_host_*_key
+        changed_when: false
+
+      - name: Restreindre les permissions des cles d'hote SSH publiques (CIS 5.1.3)
+        ansible.builtin.shell: chmod 0644 /etc/ssh/ssh_host_*_key.pub
+        changed_when: false
+
       - name: Delete cloud ssh config if exists
         ansible.builtin.file:
             path: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf

hardening/playbook-wazuh-log-forwarding.yml

@@ -0,0 +1,55 @@
+---
+# Remontee des logs web vers Wazuh : HAProxy (load-balancer) + WAF ModSecurity/CRS
+# (conteneur gestion-waf, prod-uber et replica-prod-uber). Deploie la config
+# centralisee (files/wazuh-manager/agent.conf) sur le manager, puis autorise et
+# redemarre la collecte "command" (docker logs) sur les agents qui en ont besoin.
+#
+# IMPORTANT : par securite, Wazuh ignore les localfile de type <command> pousses
+# depuis le manager tant que logcollector.remote_commands=1 n'est pas active
+# localement sur l'agent (sinon : "Remote commands are not accepted from the
+# manager" dans ossec.log). prod-uber/pre-prod-uber l'avaient deja ; ce playbook
+# le garantit aussi pour replica-prod-uber.
+
+- name: Déployer la config agent.conf centralisée sur le manager Wazuh
+  hosts: monitoring-uber
+  become: true
+  gather_facts: false
+
+  tasks:
+      - name: Copier agent.conf dans le groupe "default"
+        ansible.builtin.copy:
+            src: ../files/wazuh-manager/agent.conf
+            dest: /var/lib/docker/volumes/docker_wazuh_etc/_data/shared/default/agent.conf
+            owner: lxd
+            group: docker
+            mode: "0660"
+
+- name: Activer la collecte de commandes distantes (WAF, docker logs)
+  hosts: prod,replica-prod
+  become: true
+  gather_facts: false
+
+  tasks:
+      - name: Autoriser les localfile de type "command" poussés par le manager
+        ansible.builtin.lineinfile:
+            path: /var/ossec/etc/local_internal_options.conf
+            line: "logcollector.remote_commands=1"
+            create: true
+        notify: restart wazuh-agent
+
+  handlers:
+      - name: restart wazuh-agent
+        ansible.builtin.systemd:
+            name: wazuh-agent
+            state: restarted
+
+- name: Redémarrer l'agent load-balancer (recuperation du localfile haproxy.log)
+  hosts: load-balancer
+  become: true
+  gather_facts: false
+
+  tasks:
+      - name: Redémarrer wazuh-agent
+        ansible.builtin.systemd:
+            name: wazuh-agent
+            state: restarted

hardening/playbook-wazuh-sca-policy.yml

@@ -0,0 +1,27 @@
+---
+# Remplace la policy SCA locale "cis_ubuntu24-04" livree avec l'agent Wazuh par une
+# version allegee (checks non applicables a notre infra retires : partitions separees,
+# GDM/X11, wifi/bluetooth, ufw, nftables). Le fichier pousse via /var/ossec/etc/shared/
+# n'est PAS utilise par le module SCA quand un fichier local du meme policy id existe deja
+# (seul le premier charge, /var/ossec/ruleset/sca/, est evalue) — d'ou le remplacement direct.
+
+- name: Policy SCA Wazuh allegee (CIS Ubuntu 24.04)
+  hosts: prod,pre-prod,replica-prod,infra,infra-runner,infra-utils,ota-uber,load-balancer,!backup-mln
+  become: true
+  gather_facts: false
+
+  tasks:
+      - name: Déployer la policy SCA allégée
+        ansible.builtin.copy:
+            src: ../files/wazuh-sca/cis_ubuntu24-04.yml
+            dest: /var/ossec/ruleset/sca/cis_ubuntu24-04.yml
+            owner: root
+            group: wazuh
+            mode: "0640"
+        notify: restart wazuh-agent
+
+  handlers:
+      - name: restart wazuh-agent
+        ansible.builtin.systemd:
+            name: wazuh-agent
+            state: restarted