--- # Linode C2 Deployment Playbook # This playbook handles both redirector and C2 deployment for Linode - name: Create and configure Linode infrastructure hosts: localhost gather_facts: false connection: local vars_files: - vars.yaml vars: # Default values for required variables ssh_user: "{{ ssh_user | default('root') }}" linode_region: "{{ linode_region | default(region_choices | random) }}" plan: "{{ plan | default('g6-standard-1') }}" image: "{{ image | default('linode/debian11') }}" # Deployment mode flags redirector_only: "{{ redirector_only | default(false) }}" c2_only: "{{ c2_only | default(false) }}" # Generate random instance names if not provided redirector_name: "{{ redirector_name | default('srv-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}" c2_name: "{{ c2_name | default('node-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}" # Generate random shell handler port if not provided shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}" tasks: - name: Validate required Linode token assert: that: - linode_token is defined and linode_token != "" fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token." - name: Set the target instances to deploy based on configuration set_fact: deploy_redirector: "{{ not c2_only }}" deploy_c2: "{{ not redirector_only }}" # REDIRECTOR DEPLOYMENT - name: Deploy redirector Linode instance when: deploy_redirector block: - name: Create redirector Linode instance community.general.linode_v4: access_token: "{{ linode_token }}" label: "{{ redirector_name }}" type: "{{ plan }}" region: "{{ linode_region }}" image: "{{ image }}" root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}" authorized_keys: - "{{ lookup('file', ssh_key_path) }}" state: present register: redirector_instance - name: Set redirector_ip for later use set_fact: redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}" redirector_instance_id: "{{ redirector_instance.instance.id }}" - name: Enhanced wait for SSH with retry mechanism block: - name: Initial wait for instance to become reachable wait_for: host: "{{ linode_instance.instance.ipv4[0] }}" port: 22 delay: 60 # Increased initial delay timeout: 180 state: started register: initial_wait - name: Additional pause to ensure SSH is fully initialized pause: seconds: 120 when: initial_wait is succeeded - name: Add redirector to inventory add_host: name: "redirector" groups: "redirectors" ansible_host: "{{ redirector_ip }}" ansible_user: "{{ ssh_user }}" ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}" ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" # C2 SERVER DEPLOYMENT - name: Deploy C2 Linode instance when: deploy_c2 block: - name: Create C2 Linode instance community.general.linode_v4: access_token: "{{ linode_token }}" label: "{{ c2_name }}" type: "{{ plan }}" region: "{{ linode_region }}" image: "{{ image }}" root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}" authorized_keys: - "{{ lookup('file', ssh_key_path) }}" state: present register: c2_instance - name: Set c2_ip for later use set_fact: c2_ip: "{{ c2_instance.instance.ipv4[0] }}" c2_instance_id: "{{ c2_instance.instance.id }}" - name: Wait for C2 SSH to be available wait_for: host: "{{ c2_ip }}" port: 22 delay: 30 timeout: 300 state: started - name: Add C2 to inventory add_host: name: "c2" groups: "c2servers" ansible_host: "{{ c2_ip }}" ansible_user: "{{ ssh_user }}" ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}" ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" - name: Configure redirector server hosts: redirectors become: true gather_facts: true vars_files: - vars.yaml vars: c2_ip: "{{ hostvars['localhost']['c2_ip'] | default('127.0.0.1') }}" redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}" tasks: - name: Wait for apt to be available apt: update_cache: yes register: apt_result until: apt_result is success retries: 5 delay: 10 - name: Disable root password authentication for SSH immediately lineinfile: path: /etc/ssh/sshd_config regexp: '^#?PasswordAuthentication' line: 'PasswordAuthentication no' state: present - name: Restart SSH service to apply changes service: name: ssh state: restarted - name: Include common redirector configuration tasks include_tasks: "../tasks/configure_redirector.yml" - name: Configure C2 server hosts: c2servers become: true gather_facts: true vars_files: - vars.yaml vars: redirector_ip: "{{ hostvars['localhost']['redirector_ip'] | default('127.0.0.1') }}" c2_subdomain: "{{ c2_subdomain | default('mail') }}" tasks: - name: Wait for apt to be available apt: update_cache: yes register: apt_result until: apt_result is success retries: 5 delay: 10 - name: Disable root password authentication for SSH immediately lineinfile: path: /etc/ssh/sshd_config regexp: '^#?PasswordAuthentication' line: 'PasswordAuthentication no' state: present - name: Restart SSH service to apply changes service: name: ssh state: restarted - name: Include common tool installation tasks include_tasks: "../tasks/install_tools.yml" - name: Include common C2 configuration tasks include_tasks: "../tasks/configure_c2.yml" - name: Include common security hardening tasks include_tasks: "../tasks/security_hardening.yml" - name: Include common mail server configuration tasks include_tasks: "../tasks/configure_mail.yml" - name: Print deployment summary debug: msg: - "C2 Infrastructure Deployment Complete!" - "--------------------------------------" - "Redirector IP: {{ hostvars['localhost']['redirector_ip'] | default('Not deployed') }}" - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }}" - "C2 Server IP: {{ ansible_host }}" - "C2 Server Domain: {{ c2_subdomain }}.{{ domain }}" - "GoPhish Admin Port: {{ gophish_admin_port }}" - "Shell Handler Port: {{ shell_handler_port }}" when: not disable_summary | default(false)