external/iiab
1
0
Fork 0
mirror of https://github.com/iiab/iiab.git synced 2025-03-09 15:40:17 +00:00
Code Issues Releases Wiki Activity

Merge pull request #2651 from holta/sysctl-experiment

Browse source 
Emergency/Interim Patch + Experiment to help surface which of the 10 sysctl tweaks are still needed + necessary
This commit is contained in:
A Holt 2020-11-27 11:36:53 -05:00 • committed by GitHub
commit c215445e31
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

34
roles/2-common/tasks/main.yml
View file

@ -21,21 +21,25 @@
- include_tasks: packages.yml - include_tasks: packages.yml
- include_tasks: iptables.yml - include_tasks: iptables.yml
- name: Use 'sysctl' to set 10 network/kernel settings, turning off IPv6 if possible # 2020-11-27 emergency patch+experiment til this is answered more methodically:
sysctl: # https://github.com/iiab/iiab/issues/2650
name: "{{ item.name }}" # https://github.com/iiab/iiab/pull/2651
value: "{{ item.value }}" #
with_items: #- name: Use 'sysctl' to set 10 network/kernel settings, turning off IPv6 if possible
- { name: 'net.ipv4.ip_forward', value: '1' } # sysctl:
- { name: 'net.ipv4.conf.default.rp_filter', value: '1' } # name: "{{ item.name }}"
- { name: 'net.ipv4.conf.default.accept_source_route', value: '0' } # value: "{{ item.value }}"
- { name: 'kernel.sysrq', value: '1' } # with_items:
- { name: 'kernel.core_uses_pid', value: '1' } # - { name: 'net.ipv4.ip_forward', value: '1' }
- { name: 'net.ipv4.tcp_syncookies', value: '1' } # - { name: 'net.ipv4.conf.default.rp_filter', value: '1' }
- { name: 'kernel.shmmax', value: '268435456' } # - { name: 'net.ipv4.conf.default.accept_source_route', value: '0' }
- { name: 'net.ipv6.conf.all.disable_ipv6', value: '1' } # IPv6 disabled # - { name: 'kernel.sysrq', value: '1' }
- { name: 'net.ipv6.conf.default.disable_ipv6', value: '1' } # - { name: 'kernel.core_uses_pid', value: '1' }
- { name: 'net.ipv6.conf.lo.disable_ipv6', value: '1' } # - { name: 'net.ipv4.tcp_syncookies', value: '1' }
# - { name: 'kernel.shmmax', value: '268435456' }
# - { name: 'net.ipv6.conf.all.disable_ipv6', value: '1' } # IPv6 disabled
# - { name: 'net.ipv6.conf.default.disable_ipv6', value: '1' }
# - { name: 'net.ipv6.conf.lo.disable_ipv6', value: '1' }
- name: Install /etc/profile.d/zzz_iiab.sh from template, to add sbin dirs to unprivileged users' $PATH - name: Install /etc/profile.d/zzz_iiab.sh from template, to add sbin dirs to unprivileged users' $PATH
template: template: