CoM-c2itall/Linode/c2-deploy.yaml

---
# Linode C2 Deployment Playbook
# This playbook handles both redirector and C2 deployment for Linode

- name: Create and configure Linode infrastructure
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    # Default values for required variables
    ssh_user: "{{ ssh_user | default('root') }}"
    linode_region: "{{ linode_region | default(region_choices | random) }}"
    plan: "{{ plan | default('g6-standard-1') }}"
    image: "{{ image | default('linode/debian11') }}"
    
    # Deployment mode flags
    redirector_only: "{{ redirector_only | default(false) }}"
    c2_only: "{{ c2_only | default(false) }}"
    
    # Generate random instance names if not provided
    redirector_name: "{{ redirector_name | default('srv-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
    c2_name: "{{ c2_name | default('node-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
    
    # Generate random shell handler port if not provided
    shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"

  tasks:
    - name: Validate required Linode token
      assert:
        that:
          - linode_token is defined and linode_token != ""
        fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."
    
    - name: Set the target instances to deploy based on configuration
      set_fact:
        deploy_redirector: "{{ not c2_only }}"
        deploy_c2: "{{ not redirector_only }}"
    
    # REDIRECTOR DEPLOYMENT
    - name: Deploy redirector Linode instance
      when: deploy_redirector
      block:
        - name: Create redirector Linode instance
          community.general.linode_v4:
            access_token: "{{ linode_token }}"
            label: "{{ redirector_name }}"
            type: "{{ plan }}"
            region: "{{ linode_region }}"
            image: "{{ image }}"
            root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
            authorized_keys:
              - "{{ lookup('file', ssh_key_path) }}"
            state: present
          register: redirector_instance

        - name: Set redirector_ip for later use
          set_fact:
            redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
            redirector_instance_id: "{{ redirector_instance.instance.id }}"

        - name: Enhanced wait for SSH with retry mechanism
          block:
            - name: Initial wait for instance to become reachable
              wait_for:
                host: "{{ linode_instance.instance.ipv4[0] }}"
                port: 22
                delay: 60  # Increased initial delay
                timeout: 180
                state: started
              register: initial_wait
            
            - name: Additional pause to ensure SSH is fully initialized
              pause: 
                seconds: 120
              when: initial_wait is succeeded

        - name: Add redirector to inventory
          add_host:
            name: "redirector"
            groups: "redirectors"
            ansible_host: "{{ redirector_ip }}"
            ansible_user: "{{ ssh_user }}"
            ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
            ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"

    # C2 SERVER DEPLOYMENT
    - name: Deploy C2 Linode instance
      when: deploy_c2
      block:
        - name: Create C2 Linode instance
          community.general.linode_v4:
            access_token: "{{ linode_token }}"
            label: "{{ c2_name }}"
            type: "{{ plan }}"
            region: "{{ linode_region }}"
            image: "{{ image }}"
            root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
            authorized_keys:
              - "{{ lookup('file', ssh_key_path) }}"
            state: present
          register: c2_instance

        - name: Set c2_ip for later use
          set_fact:
            c2_ip: "{{ c2_instance.instance.ipv4[0] }}"
            c2_instance_id: "{{ c2_instance.instance.id }}"

        - name: Wait for C2 SSH to be available
          wait_for:
            host: "{{ c2_ip }}"
            port: 22
            delay: 30
            timeout: 300
            state: started

        - name: Add C2 to inventory
          add_host:
            name: "c2"
            groups: "c2servers"
            ansible_host: "{{ c2_ip }}"
            ansible_user: "{{ ssh_user }}"
            ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
            ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"

- name: Configure redirector server
  hosts: redirectors
  become: true
  gather_facts: true
  vars_files:
    - vars.yaml
  vars:
    c2_ip: "{{ hostvars['localhost']['c2_ip'] | default('127.0.0.1') }}"
    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
  tasks:
    - name: Wait for apt to be available
      apt:
        update_cache: yes
      register: apt_result
      until: apt_result is success
      retries: 5
      delay: 10
    
    - name: Disable root password authentication for SSH immediately
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present
      
    - name: Restart SSH service to apply changes
      service:
        name: ssh
        state: restarted
      
    - name: Include common redirector configuration tasks
      include_tasks: "../tasks/configure_redirector.yml"

- name: Configure C2 server
  hosts: c2servers
  become: true
  gather_facts: true
  vars_files:
    - vars.yaml
  vars:
    redirector_ip: "{{ hostvars['localhost']['redirector_ip'] | default('127.0.0.1') }}"
    c2_subdomain: "{{ c2_subdomain | default('mail') }}"
  tasks:
    - name: Wait for apt to be available
      apt:
        update_cache: yes
      register: apt_result
      until: apt_result is success
      retries: 5
      delay: 10
    
    - name: Disable root password authentication for SSH immediately
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present
      
    - name: Restart SSH service to apply changes
      service:
        name: ssh
        state: restarted

    - name: Include common tool installation tasks
      include_tasks: "../tasks/install_tools.yml"
      
    - name: Include common C2 configuration tasks
      include_tasks: "../tasks/configure_c2.yml"
      
    - name: Include common security hardening tasks
      include_tasks: "../tasks/security_hardening.yml"
      
    - name: Include common mail server configuration tasks
      include_tasks: "../tasks/configure_mail.yml"
      
    - name: Print deployment summary
      debug:
        msg:
          - "C2 Infrastructure Deployment Complete!"
          - "--------------------------------------"
          - "Redirector IP: {{ hostvars['localhost']['redirector_ip'] | default('Not deployed') }}"
          - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }}"
          - "C2 Server IP: {{ ansible_host }}"
          - "C2 Server Domain: {{ c2_subdomain }}.{{ domain }}"
          - "GoPhish Admin Port: {{ gophish_admin_port }}"
          - "Shell Handler Port: {{ shell_handler_port }}"
      when: not disable_summary | default(false)