migrate

2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
@@ -0,0 +1,134 @@
+- hosts: all
+  gather_facts: yes
+  become: yes
+  tasks:
+
+################## Configure SSH and Security Settings ##################
+
+    - name: Ensure the SSH configuration file has the correct permissions
+      file:
+        path: /etc/ssh/sshd_config
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Backup the original SSH configuration file
+      copy:
+        src: /etc/ssh/sshd_config
+        dest: /etc/ssh/sshd_config.bak
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Remove PermitRootLogin prohibit-password
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
+        state: absent
+
+    - name: Remove PasswordAuthentication yes
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitRootLogin.*yes"
+        state: absent
+
+    - name: Remove PermitEmptyPasswords no
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
+        state: absent
+
+    - name: Configure sshd
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "^(#)?{{ item.key }}"
+        line: "{{ item.key }} {{ item.value }}"
+        state: present
+      loop:
+        - { key: "PermitRootLogin", value: "no" }
+        - { key: "PasswordAuthentication", value: "no" }
+        - { key: "PermitEmptyPasswords", value: "no" }
+        - { key: "AllowUsers", value: "miker" }
+
+    - name: restart sshd
+      ansible.builtin.systemd:
+        name: sshd
+        state: restarted
+
+    - name: Setup passwordless sudo
+      lineinfile:
+        path: /etc/sudoers
+        state: present
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
+        validate: '/usr/sbin/visudo -cf %s' 
+
+################## Update and Upgrade System Packages ##################
+
+    - name: Update apt repo and cache on all Debian/Ubuntu boxes
+      apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
+
+    - name: Upgrade all packages on servers
+      apt: upgrade=dist force_apt_get=yes
+
+    - name: automatically remove unused dependencies
+      lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
+                  regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
+                  line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
+                  state=present
+                  create=yes
+
+    - name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections  - auto install security updates
+      debconf: 
+        name: unattended-upgrades 
+        question: unattended-upgrades/enable_auto_updates 
+        vtype: boolean 
+        value: 'true'
+
+    - name: apt install unattended-upgrades
+      apt: 
+        name: unattended-upgrades
+     
+    - name: dpkg-reconfigure -f noninteractive unattended-upgrades
+      command:
+        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
+        creates: /etc/apt/apt.conf.d/20auto-upgrades
+
+    - name: Check if a reboot is needed on all servers
+      register: reboot_required_file
+      stat: path=/var/run/reboot-required get_checksum=false
+
+################### Install Required System Packages ##################
+
+    - name: Update apt and install required system packages
+      apt:
+        pkg:
+          - curl
+          - wget
+          - git
+          - unattended-upgrades
+          - qemu-guest-agent
+        state: latest
+        update_cache: true
+
+    - name: Install fail2ban
+      apt:
+        name: fail2ban
+        state: latest
+        update_cache: true
+
+    - name: set up fail2ban
+      command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
+               creates=/etc/fail2ban/jail.local
+  
+  ################# Reboot if Kernel Updated ##################
+  
+    - name: Reboot the box if kernel updated
+      reboot:
+        msg: "Reboot initiated by Ansible for kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists