# Playbook for Ansible to scan for PFSA-2022-008 (postfix open relay)

# This playbook must be started from the main folder to access the dynamic data-dir inventory.
# start with:
# ansible-playbook playbooks/PFSA-2022-008/main.yml --diff --limit $hostname

- name: scan PFSA-2022-008
  gather_facts: no
  hosts: all !wemhoener-gatea-cluster-2016-prod !wemhoener-gateb-cluster-2016-prod !pf-mail !tyke !pf-git !wemhoener-lxclu05-cluster-2014-prod !wemhoener-lxclu06-cluster-2014-prod
  ignore_unreachable: yes
  serial: 10
  order: sorted


  handlers:

  - name: Reload postfix
    become: true
    service:
      name: postfix
      state: reloaded
    listen: "Reload postfix"


  tasks:

  - name: read out mynetworks
    become: true
    shell: 'test -f /usr/sbin/postconf && postconf mynetworks'
    register: output_mynetworks
    ignore_errors: yes
    check_mode: no

  - name: display mynetworks
    debug:
      var: output_mynetworks["stdout_lines"].0
    when: |
      not output_mynetworks.stdout_lines.0 is
      regex("mynetworks = 127.0.0.0/8$")
    ignore_errors: yes

  - name: configure mynetworks
    become: true
    shell: 'test -f /usr/sbin/postconf && \
      postconf -e "mynetworks=127.0.0.0/8"'
    when: |
      not output_mynetworks.stdout_lines.0 is
      regex("mynetworks = 127.0.0.0/8$")
    notify: Reload postfix


  - name: read out smtpd_recipient_restrictions
    become: true
    shell: 'test -f /usr/sbin/postconf && \
      postconf smtpd_recipient_restrictions'
    register: output_smtpd_recipient_restrictions
    ignore_errors: yes
    check_mode: no

  - name: display smtpd_recipient_restrictions
    debug:
      var: output_smtpd_recipient_restrictions["stdout_lines"].0
    when: |
      not output_smtpd_recipient_restrictions.stdout_lines.0 is
      regex("smtpd_recipient_restrictions = permit_mynetworks permit_auth_destination reject$")
    ignore_errors: yes

  - name: configure smtpd_recipient_restrictions
    become: true
    shell: 'test -f /usr/sbin/postconf && \
      postconf -e "smtpd_recipient_restrictions=permit_mynetworks permit_auth_destination reject"'
    when: |
      not output_smtpd_recipient_restrictions.stdout_lines.0 is
      regex("smtpd_recipient_restrictions = permit_mynetworks permit_auth_destination reject$")
    notify: Reload postfix


  - name: read out smtpd_relay_restrictions
    become: true
    shell: 'test -f /usr/sbin/postconf && \
      postconf smtpd_relay_restrictions'
    register: output_smtpd_relay_restrictions
    ignore_errors: yes
    check_mode: no

  - name: display smtpd_relay_restrictions
    debug:
      var: output_smtpd_relay_restrictions["stdout_lines"].0
    when: |
      not output_smtpd_relay_restrictions.stdout_lines.0 is
      regex("smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination$")
    ignore_errors: yes

  - name: configure smtpd_relay_restrictions
    become: true
    shell: 'test -f /usr/sbin/postconf && \
      postconf -e "smtpd_relay_restrictions=permit_mynetworks permit_sasl_authenticated defer_unauth_destination"'
    when: |
      not output_smtpd_relay_restrictions.stdout_lines.0 is
      regex("smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination$")
    notify: Reload postfix

  - name: git checkin
    become: true
    shell: 'git diff --quiet /etc/postfix/main.cf || { git add /etc/postfix/main.cf && git commit -m "T230963 - PFSA-2022-008: Mitigation for security finding. Changes made by Ansible." ; }'
    args:
      chdir: /etc/
