Working on security hardening

2025-05-13 13:11:27 -04:00
parent e3ad889e16
commit 67aa819ceb
4 changed files with 128 additions and 306 deletions
@@ -109,4 +109,29 @@
      when: item != omit
  when: 
    - server_role == 'logserver'
-    - not is_aws_provider
+    - not is_aws_provider
+
+- name: Update security group to allow SSH from C2 to redirector
+  block:
+    - name: Allow SSH from C2 to redirector (AWS)
+      amazon.aws.ec2_security_group:
+        name: "{{ redirector_name }}-sg"
+        description: "Security group for redirector {{ redirector_name }}"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_redirector_region }}"
+        rules:
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ c2_ip }}/32"
+        state: present
+      when: provider == "aws"
+      delegate_to: localhost
+      
+    - name: Allow SSH from C2 to redirector (UFW)
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ c2_ip }}"
+        proto: tcp
+      when: provider != "aws" and not is_aws_provider
+  when: server_role == 'redirector' and c2_ip is defined and redirector_ip is defined