ghost
145 lines
4.7 KiB
YAML
145 lines
4.7 KiB
YAML
---
|
|
# Base server hardening — applied to all deployments
|
|
# Covers: updates, firewall, fail2ban, SSH hardening
|
|
|
|
- name: Base Server Hardening
|
|
hosts: all
|
|
become: true
|
|
vars:
|
|
ssh_port: "{{ ssh_port | default(22) }}"
|
|
ssh_allow_password: false
|
|
|
|
tasks:
|
|
# ─── System Updates ─────────────────────────────────────────────────
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Upgrade all packages
|
|
apt:
|
|
upgrade: safe
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Install essential packages
|
|
apt:
|
|
name:
|
|
- ufw
|
|
- fail2ban
|
|
- unattended-upgrades
|
|
- apt-listchanges
|
|
- curl
|
|
- wget
|
|
- gnupg
|
|
- ca-certificates
|
|
- software-properties-common
|
|
state: present
|
|
when: ansible_os_family == "Debian"
|
|
|
|
# ─── UFW Firewall ───────────────────────────────────────────────────
|
|
- name: Set UFW default deny incoming
|
|
ufw:
|
|
direction: incoming
|
|
policy: deny
|
|
|
|
- name: Set UFW default allow outgoing
|
|
ufw:
|
|
direction: outgoing
|
|
policy: allow
|
|
|
|
- name: Allow SSH through UFW
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ ssh_port }}"
|
|
proto: tcp
|
|
|
|
- name: Enable UFW
|
|
ufw:
|
|
state: enabled
|
|
|
|
# ─── Fail2ban ───────────────────────────────────────────────────────
|
|
- name: Configure fail2ban SSH jail
|
|
copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[sshd]
|
|
enabled = true
|
|
port = {{ ssh_port }}
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
findtime = 600
|
|
mode: "0644"
|
|
notify: restart fail2ban
|
|
|
|
- name: Enable fail2ban
|
|
service:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
# ─── SSH Hardening ──────────────────────────────────────────────────
|
|
- name: Disable SSH password authentication
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication no"
|
|
when: not ssh_allow_password
|
|
notify: restart sshd
|
|
|
|
- name: Disable SSH root login with password
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin prohibit-password"
|
|
notify: restart sshd
|
|
|
|
- name: Disable SSH X11 forwarding
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?X11Forwarding"
|
|
line: "X11Forwarding no"
|
|
notify: restart sshd
|
|
|
|
# ─── Automatic Security Updates ─────────────────────────────────────
|
|
- name: Enable unattended upgrades for security
|
|
copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
mode: "0644"
|
|
when: ansible_os_family == "Debian"
|
|
|
|
# ─── Kernel Hardening ───────────────────────────────────────────────
|
|
- name: Apply sysctl hardening
|
|
sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_set: true
|
|
reload: true
|
|
loop:
|
|
- { key: "net.ipv4.conf.all.rp_filter", value: "1" }
|
|
- { key: "net.ipv4.conf.default.rp_filter", value: "1" }
|
|
- { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
|
|
- { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
|
|
- { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
|
|
- { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
|
|
- { key: "net.ipv6.conf.default.accept_redirects", value: "0" }
|
|
- { key: "net.ipv4.conf.all.send_redirects", value: "0" }
|
|
- { key: "net.ipv4.conf.default.send_redirects", value: "0" }
|
|
|
|
handlers:
|
|
- name: restart fail2ban
|
|
service:
|
|
name: fail2ban
|
|
state: restarted
|
|
|
|
- name: restart sshd
|
|
service:
|
|
name: sshd
|
|
state: restarted
|