reconfiging everything
This commit is contained in:
n0mad1k
+85
-106
@@ -1,118 +1,97 @@
|
||||
---
|
||||
- name: Configure FlokiNET redirector server
|
||||
hosts: redirector
|
||||
# FlokiNET Redirector-only Configuration Playbook
|
||||
# Note: FlokiNET requires pre-provisioned servers
|
||||
|
||||
- name: Prepare FlokiNET redirector configuration
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
# Generate random shell handler port if not provided
|
||||
shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
|
||||
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
|
||||
|
||||
tasks:
|
||||
- name: Validate required FlokiNET configuration
|
||||
assert:
|
||||
that:
|
||||
- redirector_ip is defined and redirector_ip != ""
|
||||
fail_msg: "FlokiNET requires redirector IP address. Set redirector_ip in vars.yaml or via --flokinet-redirector-ip."
|
||||
|
||||
- name: Add redirector to inventory
|
||||
add_host:
|
||||
name: "redirector"
|
||||
groups: "redirectors"
|
||||
ansible_host: "{{ redirector_ip }}"
|
||||
ansible_user: "{{ ssh_user | default('root') }}"
|
||||
ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
|
||||
ansible_ssh_port: "{{ ssh_port | default(22) }}"
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
|
||||
|
||||
- name: Verify SSH connection to redirector
|
||||
wait_for:
|
||||
host: "{{ redirector_ip }}"
|
||||
port: "{{ ssh_port | default(22) }}"
|
||||
delay: 10
|
||||
timeout: 60
|
||||
state: started
|
||||
ignore_errors: true
|
||||
|
||||
- name: Provision FlokiNET redirector
|
||||
hosts: redirectors
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
tasks:
|
||||
- name: Install Nginx and required packages
|
||||
ansible.builtin.apt:
|
||||
- name: Wait for apt to be available
|
||||
apt:
|
||||
update_cache: yes
|
||||
register: apt_result
|
||||
until: apt_result is success
|
||||
retries: 5
|
||||
delay: 10
|
||||
|
||||
- name: Set hostname
|
||||
hostname:
|
||||
name: "redirector"
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Upgrade all packages
|
||||
apt:
|
||||
upgrade: dist
|
||||
|
||||
- name: Install base security packages
|
||||
apt:
|
||||
name:
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- socat
|
||||
- netcat-openbsd
|
||||
- cryptsetup
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- unattended-upgrades
|
||||
- ufw
|
||||
- fail2ban
|
||||
- secure-delete
|
||||
- jq
|
||||
state: present
|
||||
become: true
|
||||
|
||||
- name: Add UFW rules for redirector
|
||||
ansible.builtin.ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
with_items:
|
||||
- 80
|
||||
- 443
|
||||
- "{{ shell_handler_port }}"
|
||||
become: true
|
||||
- name: Include common security hardening tasks
|
||||
include_tasks: "../tasks/security_hardening.yml"
|
||||
|
||||
- name: Setup directory for shell handler
|
||||
ansible.builtin.file:
|
||||
path: /opt/shell-handler
|
||||
state: directory
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
become: true
|
||||
- name: Include common redirector configuration tasks
|
||||
include_tasks: "../tasks/configure_redirector.yml"
|
||||
|
||||
- name: Copy shell handler script
|
||||
ansible.builtin.copy:
|
||||
src: "../files/persistent-listener.sh"
|
||||
dest: "/opt/shell-handler/persistent-listener.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
become: true
|
||||
|
||||
- name: Configure shell handler service
|
||||
ansible.builtin.template:
|
||||
src: templates/shell-handler.service.j2
|
||||
dest: /etc/systemd/system/shell-handler.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
become: true
|
||||
|
||||
- name: Configure NGINX for zero-logging
|
||||
ansible.builtin.template:
|
||||
src: templates/nginx.conf.j2
|
||||
dest: /etc/nginx/nginx.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
become: true
|
||||
|
||||
- name: Configure NGINX default site for C2 redirection
|
||||
ansible.builtin.template:
|
||||
src: templates/default-site.j2
|
||||
dest: /etc/nginx/sites-available/default
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
vars:
|
||||
domain: "{{ redirector_subdomain }}.{{ domain }}"
|
||||
c2_host: "{{ c2_ip }}"
|
||||
become: true
|
||||
|
||||
- name: Create index.html for legitimate-looking website
|
||||
ansible.builtin.template:
|
||||
src: templates/index.html.j2
|
||||
dest: /var/www/html/index.html
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0644'
|
||||
become: true
|
||||
|
||||
- name: Start and enable shell handler service
|
||||
ansible.builtin.systemd:
|
||||
name: shell-handler
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
become: true
|
||||
|
||||
- name: Install Let's Encrypt certificate if domain specified
|
||||
ansible.builtin.command: >
|
||||
certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
|
||||
args:
|
||||
creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
|
||||
become: true
|
||||
when: domain != "example.com"
|
||||
|
||||
- name: Restart Nginx
|
||||
ansible.builtin.service:
|
||||
name: nginx
|
||||
state: restarted
|
||||
become: true
|
||||
|
||||
- name: Display redirector setup information
|
||||
ansible.builtin.debug:
|
||||
- name: Print deployment summary
|
||||
debug:
|
||||
msg:
|
||||
- "Redirector setup completed!"
|
||||
- "IP Address: {{ ansible_host }}"
|
||||
- "Domain: {{ redirector_subdomain }}.{{ domain }}"
|
||||
- "Shell Handler Port: {{ shell_handler_port }}"
|
||||
- "Redirector Configuration Complete!"
|
||||
- "---------------------------------"
|
||||
- "Redirector IP: {{ ansible_host }}"
|
||||
- "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
|
||||
- "Shell Handler Port: {{ shell_handler_port }}"
|
||||
when: not disable_summary | default(false)
|
||||
Reference in New Issue
Block a user