134 lines
4.0 KiB
YAML
134 lines
4.0 KiB
YAML
- hosts: all
|
|
gather_facts: yes
|
|
become: yes
|
|
tasks:
|
|
|
|
################## Configure SSH and Security Settings ##################
|
|
|
|
- name: Ensure the SSH configuration file has the correct permissions
|
|
file:
|
|
path: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
|
|
- name: Backup the original SSH configuration file
|
|
copy:
|
|
src: /etc/ssh/sshd_config
|
|
dest: /etc/ssh/sshd_config.bak
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
|
|
- name: Remove PermitRootLogin prohibit-password
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
|
|
state: absent
|
|
|
|
- name: Remove PasswordAuthentication yes
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "(?i)^(?!#).*PermitRootLogin.*yes"
|
|
state: absent
|
|
|
|
- name: Remove PermitEmptyPasswords no
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
|
|
state: absent
|
|
|
|
- name: Configure sshd
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "^(#)?{{ item.key }}"
|
|
line: "{{ item.key }} {{ item.value }}"
|
|
state: present
|
|
loop:
|
|
- { key: "PermitRootLogin", value: "no" }
|
|
- { key: "PasswordAuthentication", value: "no" }
|
|
- { key: "PermitEmptyPasswords", value: "no" }
|
|
- { key: "AllowUsers", value: "miker" }
|
|
|
|
- name: restart sshd
|
|
ansible.builtin.systemd:
|
|
name: sshd
|
|
state: restarted
|
|
|
|
- name: Setup passwordless sudo
|
|
lineinfile:
|
|
path: /etc/sudoers
|
|
state: present
|
|
regexp: '^%sudo'
|
|
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
|
|
validate: '/usr/sbin/visudo -cf %s'
|
|
|
|
################## Update and Upgrade System Packages ##################
|
|
|
|
- name: Update apt repo and cache on all Debian/Ubuntu boxes
|
|
apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
|
|
|
|
- name: Upgrade all packages on servers
|
|
apt: upgrade=dist force_apt_get=yes
|
|
|
|
- name: automatically remove unused dependencies
|
|
lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
|
|
regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
|
|
line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
|
|
state=present
|
|
create=yes
|
|
|
|
- name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections - auto install security updates
|
|
debconf:
|
|
name: unattended-upgrades
|
|
question: unattended-upgrades/enable_auto_updates
|
|
vtype: boolean
|
|
value: 'true'
|
|
|
|
- name: apt install unattended-upgrades
|
|
apt:
|
|
name: unattended-upgrades
|
|
|
|
- name: dpkg-reconfigure -f noninteractive unattended-upgrades
|
|
command:
|
|
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
|
|
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
|
|
|
- name: Check if a reboot is needed on all servers
|
|
register: reboot_required_file
|
|
stat: path=/var/run/reboot-required get_checksum=false
|
|
|
|
################### Install Required System Packages ##################
|
|
|
|
- name: Update apt and install required system packages
|
|
apt:
|
|
pkg:
|
|
- curl
|
|
- wget
|
|
- git
|
|
- unattended-upgrades
|
|
- qemu-guest-agent
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: Install fail2ban
|
|
apt:
|
|
name: fail2ban
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: set up fail2ban
|
|
command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
|
|
creates=/etc/fail2ban/jail.local
|
|
|
|
################# Reboot if Kernel Updated ##################
|
|
|
|
- name: Reboot the box if kernel updated
|
|
reboot:
|
|
msg: "Reboot initiated by Ansible for kernel updates"
|
|
connect_timeout: 5
|
|
reboot_timeout: 300
|
|
pre_reboot_delay: 0
|
|
post_reboot_delay: 30
|
|
test_command: uptime
|
|
when: reboot_required_file.stat.exists |