Working on security hardening

tasks/configure_c2.yml

@@ -301,6 +301,42 @@
     job: "/root/Tools/clean-logs.sh > /dev/null 2>&1"
   when: zero_logs | bool
 
+- name: Ensure SSH key for redirector access is available
+  block:
+    - name: Copy deployment SSH key to C2 for redirector access (AWS)
+      copy:
+        src: "~/.ssh/c2deploy_{{ deployment_id }}.pem"
+        dest: "/root/.ssh/redirector_key"
+        mode: '0600'
+        owner: root
+        group: root
+      when: provider == "aws"
+      
+    - name: Copy deployment SSH key to C2 for redirector access (non-AWS)
+      copy:
+        src: "{{ ssh_key_path | replace('.pub', '') }}"
+        dest: "/root/.ssh/redirector_key"
+        mode: '0600'
+        owner: root
+        group: root
+      when: provider != "aws"
+      
+    - name: Create SSH config for redirector access
+      blockinfile:
+        path: /root/.ssh/config
+        create: yes
+        mode: '0600'
+        owner: root
+        group: root
+        marker: "# {mark} ANSIBLE MANAGED REDIRECTOR CONFIG"
+        block: |
+          Host redirector
+              HostName {{ redirector_ip }}
+              User {{ ssh_user | default('root') }}
+              IdentityFile /root/.ssh/redirector_key
+              StrictHostKeyChecking no
+  when: not redirector_only | bool and redirector_ip is defined
+
 # Include integrated tracker tasks if requested
 - name: Include integrated tracker setup
   include_tasks: "configure_integrated_tracker.yml"

tasks/traffic_flow_config.yml

@@ -109,4 +109,29 @@
       when: item != omit
   when: 
     - server_role == 'logserver'
-    - not is_aws_provider
+    - not is_aws_provider
+
+- name: Update security group to allow SSH from C2 to redirector
+  block:
+    - name: Allow SSH from C2 to redirector (AWS)
+      amazon.aws.ec2_security_group:
+        name: "{{ redirector_name }}-sg"
+        description: "Security group for redirector {{ redirector_name }}"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_redirector_region }}"
+        rules:
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ c2_ip }}/32"
+        state: present
+      when: provider == "aws"
+      delegate_to: localhost
+      
+    - name: Allow SSH from C2 to redirector (UFW)
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ c2_ip }}"
+        proto: tcp
+      when: provider != "aws" and not is_aws_provider
+  when: server_role == 'redirector' and c2_ip is defined and redirector_ip is defined