- hosts: all
  gather_facts: yes
  become: yes
  tasks:

################## Configure SSH and Security Settings ##################

    - name: Ensure the SSH configuration file has the correct permissions
      file:
        path: /etc/ssh/sshd_config
        owner: root
        group: root
        mode: '0600'

    - name: Backup the original SSH configuration file
      copy:
        src: /etc/ssh/sshd_config
        dest: /etc/ssh/sshd_config.bak
        owner: root
        group: root
        mode: '0600'
        remote_src: yes

    - name: Remove PermitRootLogin prohibit-password
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
        state: absent

    - name: Remove PasswordAuthentication yes
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "(?i)^(?!#).*PermitRootLogin.*yes"
        state: absent

    - name: Remove PermitEmptyPasswords no
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
        state: absent

    - name: Configure sshd
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "^(#)?{{ item.key }}"
        line: "{{ item.key }} {{ item.value }}"
        state: present
      loop:
        - { key: "PermitRootLogin", value: "no" }
        - { key: "PasswordAuthentication", value: "no" }
        - { key: "PermitEmptyPasswords", value: "no" }
        - { key: "AllowUsers", value: "miker" }

    - name: restart sshd
      ansible.builtin.systemd:
        name: sshd
        state: restarted

    - name: Setup passwordless sudo
      lineinfile:
        path: /etc/sudoers
        state: present
        regexp: '^%sudo'
        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
        validate: '/usr/sbin/visudo -cf %s' 

#########################################################################
######### NEW CODE ##################
#########################################################################

- hosts: all
  gather_facts: yes
  become: yes
  tasks:
    ################## SSH Hardening Enhancements ##################
    - name: Set SSH to use protocol 2 only
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^Protocol'
        line: 'Protocol 2'
        state: present

    - name: Enable public key authentication
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PubkeyAuthentication'
        line: 'PubkeyAuthentication yes'
        state: present

    - name: Disable password authentication
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present

    - name: Set preferred ciphers
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^Ciphers'
        line: 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr'
        state: present

    - name: Set key exchange algorithms
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^KexAlgorithms'
        line: 'KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
        state: present

    - name: Set LoginGraceTime to 30s
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^LoginGraceTime'
        line: 'LoginGraceTime 30'
        state: present

    - name: Disable X11 forwarding
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^X11Forwarding'
        line: 'X11Forwarding no'
        state: present

    - name: Disable TCP forwarding
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^AllowTcpForwarding'
        line: 'AllowTcpForwarding no'
        state: present

    - name: Disable PermitUserEnvironment
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitUserEnvironment'
        line: 'PermitUserEnvironment no'
        state: present

    - name: Restart sshd to apply config changes
      systemd:
        name: sshd
        state: restarted

    ################## Fail2ban Configuration ##################
    - name: Ensure Fail2ban is installed
      apt:
        name: fail2ban
        state: latest
        update_cache: yes

    - name: Setup Fail2ban jail.local for SSH
      copy:
        dest: /etc/fail2ban/jail.d/sshd.local
        content: |
          [sshd]
          enabled = true
          port = ssh
          filter = sshd
          logpath = /var/log/auth.log
          maxretry = 3
          bantime = 600
          ignoreip = 127.0.0.1/8 ::1 # Add your trusted IPs here
          action = iptables-multiport
        owner: root
        group: root
        mode: '0644'

    - name: Restart fail2ban to apply new configuration
      systemd:
        name: fail2ban
        state: restarted


#########################################################################
#########################################################################

################## Update and Upgrade System Packages ##################

    - name: Update apt repo and cache on all Debian/Ubuntu boxes
      apt: update_cache=yes force_apt_get=yes cache_valid_time=3600

    - name: Upgrade all packages on servers
      apt: upgrade=dist force_apt_get=yes

    - name: automatically remove unused dependencies
      lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
                  regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
                  line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
                  state=present
                  create=yes

    - name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections  - auto install security updates
      debconf: 
        name: unattended-upgrades 
        question: unattended-upgrades/enable_auto_updates 
        vtype: boolean 
        value: 'true'

    - name: apt install unattended-upgrades
      apt: 
        name: unattended-upgrades
     
    - name: dpkg-reconfigure -f noninteractive unattended-upgrades
      command:
        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
        creates: /etc/apt/apt.conf.d/20auto-upgrades

    - name: Check if a reboot is needed on all servers
      register: reboot_required_file
      stat: path=/var/run/reboot-required get_checksum=false

################### Install Required System Packages ##################

    - name: Update apt and install required system packages
      apt:
        pkg:
          - curl
          - wget
          - git
          - unattended-upgrades
          - qemu-guest-agent
        state: latest
        update_cache: true

    - name: Install fail2ban
      apt:
        name: fail2ban
        state: latest
        update_cache: true

    - name: set up fail2ban
      command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
               creates=/etc/fail2ban/jail.local


  ################# Reboot if Kernel Updated ##################
  
    - name: Reboot the box if kernel updated
      reboot:
        msg: "Reboot initiated by Ansible for kernel updates"
        connect_timeout: 5
        reboot_timeout: 300
        pre_reboot_delay: 0
        post_reboot_delay: 30
        test_command: uptime
      when: reboot_required_file.stat.exists