migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,22 @@
|
||||
[defaults]
|
||||
|
||||
# some basic default values...
|
||||
inventory = inventory
|
||||
sudo_user = root
|
||||
remote_user = miker
|
||||
private_key_file = $HOME/.ssh/id_rsa
|
||||
interpreter_python=auto_silent
|
||||
|
||||
# plays will gather facts by default, which contain information about
|
||||
# the remote system.
|
||||
#
|
||||
# smart - gather by default, but don't regather if already gathered
|
||||
# implicit - gather by default, turn off with gather_facts: False
|
||||
# explicit - do not gather by default, must say gather_facts: True
|
||||
gathering = smart
|
||||
|
||||
# uncomment this to disable SSH key host checking (fingerprint)
|
||||
host_key_checking = False
|
||||
|
||||
# This stop the warning message in the console for unused commands.
|
||||
deprecation_warning = False
|
||||
@@ -0,0 +1,125 @@
|
||||
---
|
||||
- name: Install docker
|
||||
hosts: "{{ my_hosts | d([]) }}"
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
tasks:
|
||||
# Install SSH Public Key
|
||||
- name: Install public keys
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ lookup('env', 'USER') }}"
|
||||
state: present
|
||||
key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
|
||||
|
||||
- name: Change sudoers file
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/sudoers
|
||||
state: present
|
||||
regexp: '^%sudo'
|
||||
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
|
||||
validate: /usr/sbin/visudo -cf %s
|
||||
|
||||
# Update the system
|
||||
- name: Update package index
|
||||
apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Upgrade packages
|
||||
apt:
|
||||
upgrade: yes
|
||||
|
||||
- name: Perform a distro upgrade
|
||||
ansible.builtin.apt:
|
||||
upgrade: dist
|
||||
update_cache: yes
|
||||
|
||||
- name: Remove dependencies that are no longer needed
|
||||
ansible.builtin.apt:
|
||||
autoremove: yes
|
||||
purge: true
|
||||
|
||||
- name: Update all packages to their latest version
|
||||
ansible.builtin.apt:
|
||||
name: "*"
|
||||
state: latest
|
||||
|
||||
- name: Run the equivalent of "apt-get clean" as a separate step
|
||||
ansible.builtin.apt:
|
||||
clean: yes
|
||||
|
||||
# Install Docker and all its dependencies
|
||||
- name: Install docker dependencies
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg-agent
|
||||
- software-properties-common
|
||||
update_cache: true
|
||||
|
||||
- name: Add docker gpg key
|
||||
ansible.builtin.apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
state: present
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
|
||||
- name: Add docker repository
|
||||
ansible.builtin.apt_repository:
|
||||
filename: docker
|
||||
repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename | lower }} stable
|
||||
state: present
|
||||
|
||||
- name: Update package index
|
||||
apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Install docker engine
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
update_cache: true
|
||||
|
||||
# Install Portainer and its volume
|
||||
- name: Create new volume
|
||||
community.docker.docker_volume:
|
||||
name: portainer-data
|
||||
|
||||
- name: Deploy portainer
|
||||
community.docker.docker_container:
|
||||
name: portainer
|
||||
image: "docker.io/portainer/portainer-ce"
|
||||
ports:
|
||||
- "9445:9443"
|
||||
volumes:
|
||||
- /run/docker.sock:/var/run/docker.sock
|
||||
- portainer-data:/data
|
||||
restart_policy: unless-stopped
|
||||
|
||||
# Install Watch Tower
|
||||
tasks:
|
||||
- name: Ensure Docker is running
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Create Watchtower directory for configuration (optional, for persistent configuration)
|
||||
file:
|
||||
path: /opt/watchtower
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Run Watchtower container
|
||||
community.docker.docker_container:
|
||||
name: watchtower
|
||||
image: containrrr/watchtower
|
||||
restart_policy: unless-stopped
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock # Required for Watchtower to interact with Docker
|
||||
# - /opt/watchtower/config.json:/config.json # Optional: for persistent configuration
|
||||
# command: --interval 300 # Optional: specify update interval in seconds
|
||||
state: started
|
||||
@@ -0,0 +1 @@
|
||||
192.168.2.14
|
||||
@@ -0,0 +1,143 @@
|
||||
- hosts: all
|
||||
gather_facts: yes
|
||||
become: yes
|
||||
tasks:
|
||||
################## SSH and Security Configuration ##################
|
||||
- name: Set SSH configuration permissions
|
||||
file:
|
||||
path: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Backup original SSH configuration file (if not exists)
|
||||
copy:
|
||||
src: /etc/ssh/sshd_config
|
||||
dest: /etc/ssh/sshd_config.bak
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
remote_src: yes
|
||||
force: no
|
||||
|
||||
- name: Remove undesired PermitRootLogin and PasswordAuthentication lines
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^(?!#).*PermitRootLogin.*$|^(?!#).*PasswordAuthentication.*$|^(?!#).*PermitEmptyPasswords.*$'
|
||||
state: absent
|
||||
|
||||
- name: Apply consolidated SSH config settings
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^(#)?{{ item.key }}"
|
||||
line: "{{ item.key }} {{ item.value }}"
|
||||
state: present
|
||||
loop:
|
||||
- { key: "PermitRootLogin", value: "no" }
|
||||
- { key: "PasswordAuthentication", value: "no" }
|
||||
- { key: "PermitEmptyPasswords", value: "no" }
|
||||
- { key: "AllowUsers", value: "miker" }
|
||||
- { key: "Protocol", value: "2" }
|
||||
- { key: "PubkeyAuthentication", value: "yes" }
|
||||
- { key: "Ciphers", value: "aes256-ctr,aes192-ctr,aes128-ctr" }
|
||||
- { key: "KexAlgorithms", value: "curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256" }
|
||||
- { key: "LoginGraceTime", value: "30" }
|
||||
- { key: "X11Forwarding", value: "no" }
|
||||
- { key: "AllowTcpForwarding", value: "no" }
|
||||
- { key: "PermitUserEnvironment", value: "no" }
|
||||
|
||||
- name: Restart sshd to apply changes
|
||||
systemd:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Setup passwordless sudo for sudo group
|
||||
lineinfile:
|
||||
path: /etc/sudoers
|
||||
state: present
|
||||
regexp: '^%sudo'
|
||||
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
|
||||
validate: '/usr/sbin/visudo -cf %s'
|
||||
|
||||
################## System Package Management ##################
|
||||
- name: Update apt cache and upgrade all packages
|
||||
apt:
|
||||
update_cache: yes
|
||||
upgrade: dist
|
||||
force_apt_get: yes
|
||||
|
||||
- name: Enable removal of unused dependencies in unattended-upgrades
|
||||
lineinfile:
|
||||
path: /etc/apt/apt.conf.d/50unattended-upgrades
|
||||
regexp: '^Unattended-Upgrade::Remove-Unused-Dependencies'
|
||||
line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
|
||||
state: present
|
||||
create: yes
|
||||
|
||||
- name: Enable auto updates via debconf
|
||||
debconf:
|
||||
name: unattended-upgrades
|
||||
question: unattended-upgrades/enable_auto_updates
|
||||
vtype: boolean
|
||||
value: 'true'
|
||||
|
||||
- name: Install unattended-upgrades package
|
||||
apt:
|
||||
name: unattended-upgrades
|
||||
state: latest
|
||||
|
||||
- name: Run dpkg reconfigure for unattended-upgrades
|
||||
command:
|
||||
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
|
||||
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
|
||||
################## Install and Configure Fail2ban ##################
|
||||
- name: Install required system packages including fail2ban
|
||||
apt:
|
||||
name:
|
||||
- curl
|
||||
- wget
|
||||
- git
|
||||
- unattended-upgrades
|
||||
- qemu-guest-agent
|
||||
- fail2ban
|
||||
state: latest
|
||||
update_cache: yes
|
||||
|
||||
- name: Setup fail2ban jail.local for sshd
|
||||
copy:
|
||||
dest: /etc/fail2ban/jail.d/sshd.local
|
||||
content: |
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = ssh
|
||||
filter = sshd
|
||||
logpath = /var/log/auth.log
|
||||
maxretry = 3
|
||||
bantime = 600
|
||||
ignoreip = 127.0.0.1/8 ::1
|
||||
action = iptables-multiport
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Restart fail2ban service
|
||||
systemd:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
|
||||
################## Kernel Update & Reboot ##################
|
||||
- name: Check for pending reboot
|
||||
stat:
|
||||
path: /var/run/reboot-required
|
||||
register: reboot_required_file
|
||||
|
||||
- name: Reboot if kernel updated
|
||||
reboot:
|
||||
msg: "Reboot initiated by Ansible for kernel updates"
|
||||
connect_timeout: 5
|
||||
reboot_timeout: 300
|
||||
pre_reboot_delay: 0
|
||||
post_reboot_delay: 30
|
||||
test_command: uptime
|
||||
when: reboot_required_file.stat.exists
|
||||
@@ -0,0 +1,246 @@
|
||||
- hosts: all
|
||||
gather_facts: yes
|
||||
become: yes
|
||||
tasks:
|
||||
|
||||
################## Configure SSH and Security Settings ##################
|
||||
|
||||
- name: Ensure the SSH configuration file has the correct permissions
|
||||
file:
|
||||
path: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Backup the original SSH configuration file
|
||||
copy:
|
||||
src: /etc/ssh/sshd_config
|
||||
dest: /etc/ssh/sshd_config.bak
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
remote_src: yes
|
||||
|
||||
- name: Remove PermitRootLogin prohibit-password
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
|
||||
state: absent
|
||||
|
||||
- name: Remove PasswordAuthentication yes
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "(?i)^(?!#).*PermitRootLogin.*yes"
|
||||
state: absent
|
||||
|
||||
- name: Remove PermitEmptyPasswords no
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
|
||||
state: absent
|
||||
|
||||
- name: Configure sshd
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "^(#)?{{ item.key }}"
|
||||
line: "{{ item.key }} {{ item.value }}"
|
||||
state: present
|
||||
loop:
|
||||
- { key: "PermitRootLogin", value: "no" }
|
||||
- { key: "PasswordAuthentication", value: "no" }
|
||||
- { key: "PermitEmptyPasswords", value: "no" }
|
||||
- { key: "AllowUsers", value: "miker" }
|
||||
|
||||
- name: restart sshd
|
||||
ansible.builtin.systemd:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Setup passwordless sudo
|
||||
lineinfile:
|
||||
path: /etc/sudoers
|
||||
state: present
|
||||
regexp: '^%sudo'
|
||||
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
|
||||
validate: '/usr/sbin/visudo -cf %s'
|
||||
|
||||
#########################################################################
|
||||
######### NEW CODE ##################
|
||||
#########################################################################
|
||||
|
||||
- hosts: all
|
||||
gather_facts: yes
|
||||
become: yes
|
||||
tasks:
|
||||
################## SSH Hardening Enhancements ##################
|
||||
- name: Set SSH to use protocol 2 only
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^Protocol'
|
||||
line: 'Protocol 2'
|
||||
state: present
|
||||
|
||||
- name: Enable public key authentication
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^PubkeyAuthentication'
|
||||
line: 'PubkeyAuthentication yes'
|
||||
state: present
|
||||
|
||||
- name: Disable password authentication
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^PasswordAuthentication'
|
||||
line: 'PasswordAuthentication no'
|
||||
state: present
|
||||
|
||||
- name: Set preferred ciphers
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^Ciphers'
|
||||
line: 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr'
|
||||
state: present
|
||||
|
||||
- name: Set key exchange algorithms
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^KexAlgorithms'
|
||||
line: 'KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
|
||||
state: present
|
||||
|
||||
- name: Set LoginGraceTime to 30s
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^LoginGraceTime'
|
||||
line: 'LoginGraceTime 30'
|
||||
state: present
|
||||
|
||||
- name: Disable X11 forwarding
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^X11Forwarding'
|
||||
line: 'X11Forwarding no'
|
||||
state: present
|
||||
|
||||
- name: Disable TCP forwarding
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^AllowTcpForwarding'
|
||||
line: 'AllowTcpForwarding no'
|
||||
state: present
|
||||
|
||||
- name: Disable PermitUserEnvironment
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^PermitUserEnvironment'
|
||||
line: 'PermitUserEnvironment no'
|
||||
state: present
|
||||
|
||||
- name: Restart sshd to apply config changes
|
||||
systemd:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
################## Fail2ban Configuration ##################
|
||||
- name: Ensure Fail2ban is installed
|
||||
apt:
|
||||
name: fail2ban
|
||||
state: latest
|
||||
update_cache: yes
|
||||
|
||||
- name: Setup Fail2ban jail.local for SSH
|
||||
copy:
|
||||
dest: /etc/fail2ban/jail.d/sshd.local
|
||||
content: |
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = ssh
|
||||
filter = sshd
|
||||
logpath = /var/log/auth.log
|
||||
maxretry = 3
|
||||
bantime = 600
|
||||
ignoreip = 127.0.0.1/8 ::1 # Add your trusted IPs here
|
||||
action = iptables-multiport
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Restart fail2ban to apply new configuration
|
||||
systemd:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
|
||||
|
||||
#########################################################################
|
||||
#########################################################################
|
||||
|
||||
################## Update and Upgrade System Packages ##################
|
||||
|
||||
- name: Update apt repo and cache on all Debian/Ubuntu boxes
|
||||
apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
|
||||
|
||||
- name: Upgrade all packages on servers
|
||||
apt: upgrade=dist force_apt_get=yes
|
||||
|
||||
- name: automatically remove unused dependencies
|
||||
lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
|
||||
regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
|
||||
line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
|
||||
state=present
|
||||
create=yes
|
||||
|
||||
- name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections - auto install security updates
|
||||
debconf:
|
||||
name: unattended-upgrades
|
||||
question: unattended-upgrades/enable_auto_updates
|
||||
vtype: boolean
|
||||
value: 'true'
|
||||
|
||||
- name: apt install unattended-upgrades
|
||||
apt:
|
||||
name: unattended-upgrades
|
||||
|
||||
- name: dpkg-reconfigure -f noninteractive unattended-upgrades
|
||||
command:
|
||||
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
|
||||
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
|
||||
- name: Check if a reboot is needed on all servers
|
||||
register: reboot_required_file
|
||||
stat: path=/var/run/reboot-required get_checksum=false
|
||||
|
||||
################### Install Required System Packages ##################
|
||||
|
||||
- name: Update apt and install required system packages
|
||||
apt:
|
||||
pkg:
|
||||
- curl
|
||||
- wget
|
||||
- git
|
||||
- unattended-upgrades
|
||||
- qemu-guest-agent
|
||||
state: latest
|
||||
update_cache: true
|
||||
|
||||
- name: Install fail2ban
|
||||
apt:
|
||||
name: fail2ban
|
||||
state: latest
|
||||
update_cache: true
|
||||
|
||||
- name: set up fail2ban
|
||||
command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
|
||||
creates=/etc/fail2ban/jail.local
|
||||
|
||||
|
||||
################# Reboot if Kernel Updated ##################
|
||||
|
||||
- name: Reboot the box if kernel updated
|
||||
reboot:
|
||||
msg: "Reboot initiated by Ansible for kernel updates"
|
||||
connect_timeout: 5
|
||||
reboot_timeout: 300
|
||||
pre_reboot_delay: 0
|
||||
post_reboot_delay: 30
|
||||
test_command: uptime
|
||||
when: reboot_required_file.stat.exists
|
||||
Reference in New Issue
Block a user