n0mad1k
144 lines
3.7 KiB
YAML
144 lines
3.7 KiB
YAML
---
|
|
# Security hardening tasks for C2 server
|
|
|
|
- name: Check if system is updated
|
|
apt:
|
|
update_cache: yes
|
|
register: apt_update_result
|
|
until: apt_update_result is success
|
|
retries: 5
|
|
delay: 5
|
|
|
|
- name: Install security packages
|
|
apt:
|
|
name:
|
|
- fail2ban
|
|
- ufw
|
|
- unattended-upgrades
|
|
- debsums
|
|
- aide
|
|
- rkhunter
|
|
- logrotate
|
|
state: present
|
|
register: package_install
|
|
until: package_install is success
|
|
retries: 3
|
|
delay: 5
|
|
|
|
- name: Configure UFW default policies
|
|
ufw:
|
|
state: enabled
|
|
policy: deny
|
|
direction: incoming
|
|
ignore_errors: yes
|
|
|
|
- name: Allow required ports through firewall
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "22"
|
|
- "80"
|
|
- "443"
|
|
- "{{ havoc_teamserver_port | default('40056') }}"
|
|
- "{{ havoc_http_port | default('8080') }}"
|
|
- "{{ gophish_admin_port | default('3333') }}"
|
|
ignore_errors: yes
|
|
|
|
- name: Set up fail2ban SSH jail
|
|
copy:
|
|
dest: /etc/fail2ban/jail.d/sshd.conf
|
|
content: |
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
mode: '0644'
|
|
register: fail2ban_config_updated
|
|
|
|
- name: Enable automatic security updates
|
|
copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
mode: '0644'
|
|
|
|
- name: Create log cleaning script if zero-logs is enabled
|
|
copy:
|
|
dest: /root/Tools/clean-logs.sh
|
|
content: |
|
|
#!/bin/bash
|
|
# Log cleaning script
|
|
echo "Cleaning system logs at $(date)"
|
|
|
|
# Clear auth logs
|
|
echo "" > /var/log/auth.log
|
|
echo "" > /var/log/auth.log.1
|
|
|
|
# Clear syslog
|
|
echo "" > /var/log/syslog
|
|
echo "" > /var/log/syslog.1
|
|
|
|
# Clear application specific logs
|
|
find /var/log -type f -name "*.log" -exec truncate -s 0 {} \;
|
|
|
|
# Clear bash history
|
|
cat /dev/null > ~/.bash_history
|
|
history -c
|
|
|
|
echo "Log cleaning completed at $(date)"
|
|
mode: '0700'
|
|
when: zero_logs | default(false) | bool
|
|
|
|
# SSH Hardening
|
|
- name: Harden SSH configuration
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
state: present
|
|
loop:
|
|
- { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
|
|
- { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
|
|
- { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
|
|
- { regexp: '^#?MaxAuthTries', line: 'MaxAuthTries 3' }
|
|
- { regexp: '^#?AllowTcpForwarding', line: 'AllowTcpForwarding yes' }
|
|
- { regexp: '^#?ClientAliveInterval', line: 'ClientAliveInterval 300' }
|
|
- { regexp: '^#?ClientAliveCountMax', line: 'ClientAliveCountMax 2' }
|
|
register: ssh_config_updated
|
|
|
|
- name: Configure system resource limits
|
|
pam_limits:
|
|
domain: "*"
|
|
limit_type: "{{ item.limit_type }}"
|
|
limit_item: "{{ item.limit_item }}"
|
|
value: "{{ item.value }}"
|
|
loop:
|
|
- { limit_type: soft, limit_item: nofile, value: 65535 }
|
|
- { limit_type: hard, limit_item: nofile, value: 65535 }
|
|
- { limit_type: soft, limit_item: nproc, value: 4096 }
|
|
- { limit_type: hard, limit_item: nproc, value: 4096 }
|
|
|
|
# Service restart handlers
|
|
- name: Restart SSH service if configuration changed
|
|
service:
|
|
name: ssh
|
|
state: restarted
|
|
when: ssh_config_updated.changed
|
|
|
|
- name: Check if fail2ban service exists
|
|
stat:
|
|
path: "/etc/init.d/fail2ban"
|
|
register: fail2ban_service_stat
|
|
|
|
- name: Restart fail2ban service if installed and configuration changed
|
|
service:
|
|
name: fail2ban
|
|
state: restarted
|
|
when: fail2ban_service_stat.stat.exists and fail2ban_config_updated.changed |