247 lines
7.2 KiB
YAML
247 lines
7.2 KiB
YAML
- hosts: all
|
|
gather_facts: yes
|
|
become: yes
|
|
tasks:
|
|
|
|
################## Configure SSH and Security Settings ##################
|
|
|
|
- name: Ensure the SSH configuration file has the correct permissions
|
|
file:
|
|
path: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
|
|
- name: Backup the original SSH configuration file
|
|
copy:
|
|
src: /etc/ssh/sshd_config
|
|
dest: /etc/ssh/sshd_config.bak
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
remote_src: yes
|
|
|
|
- name: Remove PermitRootLogin prohibit-password
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
|
|
state: absent
|
|
|
|
- name: Remove PasswordAuthentication yes
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "(?i)^(?!#).*PermitRootLogin.*yes"
|
|
state: absent
|
|
|
|
- name: Remove PermitEmptyPasswords no
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
|
|
state: absent
|
|
|
|
- name: Configure sshd
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "^(#)?{{ item.key }}"
|
|
line: "{{ item.key }} {{ item.value }}"
|
|
state: present
|
|
loop:
|
|
- { key: "PermitRootLogin", value: "no" }
|
|
- { key: "PasswordAuthentication", value: "no" }
|
|
- { key: "PermitEmptyPasswords", value: "no" }
|
|
- { key: "AllowUsers", value: "miker" }
|
|
|
|
- name: restart sshd
|
|
ansible.builtin.systemd:
|
|
name: sshd
|
|
state: restarted
|
|
|
|
- name: Setup passwordless sudo
|
|
lineinfile:
|
|
path: /etc/sudoers
|
|
state: present
|
|
regexp: '^%sudo'
|
|
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
|
|
validate: '/usr/sbin/visudo -cf %s'
|
|
|
|
#########################################################################
|
|
######### NEW CODE ##################
|
|
#########################################################################
|
|
|
|
- hosts: all
|
|
gather_facts: yes
|
|
become: yes
|
|
tasks:
|
|
################## SSH Hardening Enhancements ##################
|
|
- name: Set SSH to use protocol 2 only
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^Protocol'
|
|
line: 'Protocol 2'
|
|
state: present
|
|
|
|
- name: Enable public key authentication
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^PubkeyAuthentication'
|
|
line: 'PubkeyAuthentication yes'
|
|
state: present
|
|
|
|
- name: Disable password authentication
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^PasswordAuthentication'
|
|
line: 'PasswordAuthentication no'
|
|
state: present
|
|
|
|
- name: Set preferred ciphers
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^Ciphers'
|
|
line: 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr'
|
|
state: present
|
|
|
|
- name: Set key exchange algorithms
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^KexAlgorithms'
|
|
line: 'KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
|
|
state: present
|
|
|
|
- name: Set LoginGraceTime to 30s
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^LoginGraceTime'
|
|
line: 'LoginGraceTime 30'
|
|
state: present
|
|
|
|
- name: Disable X11 forwarding
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^X11Forwarding'
|
|
line: 'X11Forwarding no'
|
|
state: present
|
|
|
|
- name: Disable TCP forwarding
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^AllowTcpForwarding'
|
|
line: 'AllowTcpForwarding no'
|
|
state: present
|
|
|
|
- name: Disable PermitUserEnvironment
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^PermitUserEnvironment'
|
|
line: 'PermitUserEnvironment no'
|
|
state: present
|
|
|
|
- name: Restart sshd to apply config changes
|
|
systemd:
|
|
name: sshd
|
|
state: restarted
|
|
|
|
################## Fail2ban Configuration ##################
|
|
- name: Ensure Fail2ban is installed
|
|
apt:
|
|
name: fail2ban
|
|
state: latest
|
|
update_cache: yes
|
|
|
|
- name: Setup Fail2ban jail.local for SSH
|
|
copy:
|
|
dest: /etc/fail2ban/jail.d/sshd.local
|
|
content: |
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
bantime = 600
|
|
ignoreip = 127.0.0.1/8 ::1 # Add your trusted IPs here
|
|
action = iptables-multiport
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Restart fail2ban to apply new configuration
|
|
systemd:
|
|
name: fail2ban
|
|
state: restarted
|
|
|
|
|
|
#########################################################################
|
|
#########################################################################
|
|
|
|
################## Update and Upgrade System Packages ##################
|
|
|
|
- name: Update apt repo and cache on all Debian/Ubuntu boxes
|
|
apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
|
|
|
|
- name: Upgrade all packages on servers
|
|
apt: upgrade=dist force_apt_get=yes
|
|
|
|
- name: automatically remove unused dependencies
|
|
lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
|
|
regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
|
|
line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
|
|
state=present
|
|
create=yes
|
|
|
|
- name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections - auto install security updates
|
|
debconf:
|
|
name: unattended-upgrades
|
|
question: unattended-upgrades/enable_auto_updates
|
|
vtype: boolean
|
|
value: 'true'
|
|
|
|
- name: apt install unattended-upgrades
|
|
apt:
|
|
name: unattended-upgrades
|
|
|
|
- name: dpkg-reconfigure -f noninteractive unattended-upgrades
|
|
command:
|
|
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
|
|
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
|
|
|
- name: Check if a reboot is needed on all servers
|
|
register: reboot_required_file
|
|
stat: path=/var/run/reboot-required get_checksum=false
|
|
|
|
################### Install Required System Packages ##################
|
|
|
|
- name: Update apt and install required system packages
|
|
apt:
|
|
pkg:
|
|
- curl
|
|
- wget
|
|
- git
|
|
- unattended-upgrades
|
|
- qemu-guest-agent
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: Install fail2ban
|
|
apt:
|
|
name: fail2ban
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: set up fail2ban
|
|
command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
|
|
creates=/etc/fail2ban/jail.local
|
|
|
|
|
|
################# Reboot if Kernel Updated ##################
|
|
|
|
- name: Reboot the box if kernel updated
|
|
reboot:
|
|
msg: "Reboot initiated by Ansible for kernel updates"
|
|
connect_timeout: 5
|
|
reboot_timeout: 300
|
|
pre_reboot_delay: 0
|
|
post_reboot_delay: 30
|
|
test_command: uptime
|
|
when: reboot_required_file.stat.exists
|