The ``common`` role can be used for applying a common configuration and

hardening across all servers, no matter what services they provide.

The role implements the following:

* Configures apt to use caching proxy (if any was specified).

* Sets-up umask for all logins to ``0027``.

* Installs sudo.

* Sets-up uniform bash prompt for all accounts (optionally coloured and with

  identifier). This is useful for distinguishing machines and/or environments.

* Installs additional base packages, as configured.

* Creates additional operating system groups, as configured.

* Creates additional operating system users, as configured.

* Hardens the SSH server by disabling remote ``root`` logins and password-based

  authentication.

* Allows traversing of directory ``/etc/ssl/private/`` to everyone. This lets

  you put TLS private keys in central location where any operating system user

  can reach them provided they have appropriate read/write rights on the file

  itself, and provided they know the exact path of the file.

* Deploys CA certificate files, normally used for truststore purposes, to

  ``/usr/local/share/ca-certificates/``.

* Installs ``ferm`` (for iptables management), configuring a basic firewall

  which allows ICMP echo requests (PING), incoming connection on TCP port 22

  apt: name=sudo state=present

- name: Install ssl-cert package

  apt: name=ssl-cert state=present

- name: Install rcconf (workaround for systemctl broken handling of SysV)

  apt: name=rcconf state=present

- name: Install common packages

  apt: name="{{ item }}" state="present"

  with_items: "{{ common_packages }}"

- name: Set-up operating system groups

  group: name="{{ item.name }}" gid="{{ item.gid | default(omit) }}" state=present

  with_items: "{{ os_groups }}"

- name: Set-up operating system user groups

  group: name="{{ item.name }}" gid="{{ item.uid | default(omit) }}" state=present

  with_items: "{{ os_users }}"

- name: Set-up operating system users

  user: name="{{ item.name }}" uid="{{ item.uid | default(omit) }}" group="{{ item.name }}"

        groups="{{ ",".join(item.additional_groups | default([])) }}" append=yes shell=/bin/bash state=present

        password="{{ item.password | default('!') }}" update_password=on_create