migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,246 @@
|
||||
- hosts: all
|
||||
gather_facts: yes
|
||||
become: yes
|
||||
tasks:
|
||||
|
||||
################## Configure SSH and Security Settings ##################
|
||||
|
||||
- name: Ensure the SSH configuration file has the correct permissions
|
||||
file:
|
||||
path: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Backup the original SSH configuration file
|
||||
copy:
|
||||
src: /etc/ssh/sshd_config
|
||||
dest: /etc/ssh/sshd_config.bak
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
remote_src: yes
|
||||
|
||||
- name: Remove PermitRootLogin prohibit-password
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
|
||||
state: absent
|
||||
|
||||
- name: Remove PasswordAuthentication yes
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "(?i)^(?!#).*PermitRootLogin.*yes"
|
||||
state: absent
|
||||
|
||||
- name: Remove PermitEmptyPasswords no
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
|
||||
state: absent
|
||||
|
||||
- name: Configure sshd
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regex: "^(#)?{{ item.key }}"
|
||||
line: "{{ item.key }} {{ item.value }}"
|
||||
state: present
|
||||
loop:
|
||||
- { key: "PermitRootLogin", value: "no" }
|
||||
- { key: "PasswordAuthentication", value: "no" }
|
||||
- { key: "PermitEmptyPasswords", value: "no" }
|
||||
- { key: "AllowUsers", value: "miker" }
|
||||
|
||||
- name: restart sshd
|
||||
ansible.builtin.systemd:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Setup passwordless sudo
|
||||
lineinfile:
|
||||
path: /etc/sudoers
|
||||
state: present
|
||||
regexp: '^%sudo'
|
||||
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
|
||||
validate: '/usr/sbin/visudo -cf %s'
|
||||
|
||||
#########################################################################
|
||||
######### NEW CODE ##################
|
||||
#########################################################################
|
||||
|
||||
- hosts: all
|
||||
gather_facts: yes
|
||||
become: yes
|
||||
tasks:
|
||||
################## SSH Hardening Enhancements ##################
|
||||
- name: Set SSH to use protocol 2 only
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^Protocol'
|
||||
line: 'Protocol 2'
|
||||
state: present
|
||||
|
||||
- name: Enable public key authentication
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^PubkeyAuthentication'
|
||||
line: 'PubkeyAuthentication yes'
|
||||
state: present
|
||||
|
||||
- name: Disable password authentication
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^PasswordAuthentication'
|
||||
line: 'PasswordAuthentication no'
|
||||
state: present
|
||||
|
||||
- name: Set preferred ciphers
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^Ciphers'
|
||||
line: 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr'
|
||||
state: present
|
||||
|
||||
- name: Set key exchange algorithms
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^KexAlgorithms'
|
||||
line: 'KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
|
||||
state: present
|
||||
|
||||
- name: Set LoginGraceTime to 30s
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^LoginGraceTime'
|
||||
line: 'LoginGraceTime 30'
|
||||
state: present
|
||||
|
||||
- name: Disable X11 forwarding
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^X11Forwarding'
|
||||
line: 'X11Forwarding no'
|
||||
state: present
|
||||
|
||||
- name: Disable TCP forwarding
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^AllowTcpForwarding'
|
||||
line: 'AllowTcpForwarding no'
|
||||
state: present
|
||||
|
||||
- name: Disable PermitUserEnvironment
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^PermitUserEnvironment'
|
||||
line: 'PermitUserEnvironment no'
|
||||
state: present
|
||||
|
||||
- name: Restart sshd to apply config changes
|
||||
systemd:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
################## Fail2ban Configuration ##################
|
||||
- name: Ensure Fail2ban is installed
|
||||
apt:
|
||||
name: fail2ban
|
||||
state: latest
|
||||
update_cache: yes
|
||||
|
||||
- name: Setup Fail2ban jail.local for SSH
|
||||
copy:
|
||||
dest: /etc/fail2ban/jail.d/sshd.local
|
||||
content: |
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = ssh
|
||||
filter = sshd
|
||||
logpath = /var/log/auth.log
|
||||
maxretry = 3
|
||||
bantime = 600
|
||||
ignoreip = 127.0.0.1/8 ::1 # Add your trusted IPs here
|
||||
action = iptables-multiport
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Restart fail2ban to apply new configuration
|
||||
systemd:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
|
||||
|
||||
#########################################################################
|
||||
#########################################################################
|
||||
|
||||
################## Update and Upgrade System Packages ##################
|
||||
|
||||
- name: Update apt repo and cache on all Debian/Ubuntu boxes
|
||||
apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
|
||||
|
||||
- name: Upgrade all packages on servers
|
||||
apt: upgrade=dist force_apt_get=yes
|
||||
|
||||
- name: automatically remove unused dependencies
|
||||
lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
|
||||
regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
|
||||
line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
|
||||
state=present
|
||||
create=yes
|
||||
|
||||
- name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections - auto install security updates
|
||||
debconf:
|
||||
name: unattended-upgrades
|
||||
question: unattended-upgrades/enable_auto_updates
|
||||
vtype: boolean
|
||||
value: 'true'
|
||||
|
||||
- name: apt install unattended-upgrades
|
||||
apt:
|
||||
name: unattended-upgrades
|
||||
|
||||
- name: dpkg-reconfigure -f noninteractive unattended-upgrades
|
||||
command:
|
||||
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
|
||||
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
|
||||
- name: Check if a reboot is needed on all servers
|
||||
register: reboot_required_file
|
||||
stat: path=/var/run/reboot-required get_checksum=false
|
||||
|
||||
################### Install Required System Packages ##################
|
||||
|
||||
- name: Update apt and install required system packages
|
||||
apt:
|
||||
pkg:
|
||||
- curl
|
||||
- wget
|
||||
- git
|
||||
- unattended-upgrades
|
||||
- qemu-guest-agent
|
||||
state: latest
|
||||
update_cache: true
|
||||
|
||||
- name: Install fail2ban
|
||||
apt:
|
||||
name: fail2ban
|
||||
state: latest
|
||||
update_cache: true
|
||||
|
||||
- name: set up fail2ban
|
||||
command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
|
||||
creates=/etc/fail2ban/jail.local
|
||||
|
||||
|
||||
################# Reboot if Kernel Updated ##################
|
||||
|
||||
- name: Reboot the box if kernel updated
|
||||
reboot:
|
||||
msg: "Reboot initiated by Ansible for kernel updates"
|
||||
connect_timeout: 5
|
||||
reboot_timeout: 300
|
||||
pre_reboot_delay: 0
|
||||
post_reboot_delay: 30
|
||||
test_command: uptime
|
||||
when: reboot_required_file.stat.exists
|
||||
Reference in New Issue
Block a user