122 lines
2.5 KiB
YAML
122 lines
2.5 KiB
YAML
|
- name: Secure Debian VPS
|
||
|
|
hosts: vipy
|
||
|
|
vars_files:
|
||
|
|
- vars.yml
|
||
|
|
become: true
|
||
|
|
|
||
|
|
tasks:
|
||
|
|
- name: Update and upgrade apt packages
|
||
|
|
apt:
|
||
|
|
update_cache: yes
|
||
|
|
upgrade: full
|
||
|
|
autoremove: yes
|
||
|
|
|
||
|
|
- name: Create new user
|
||
|
|
user:
|
||
|
|
name: "{{ new_user }}"
|
||
|
|
groups: sudo
|
||
|
|
shell: /bin/bash
|
||
|
|
state: present
|
||
|
|
create_home: yes
|
||
|
|
|
||
|
|
- name: Set up SSH directory for new user
|
||
|
|
file:
|
||
|
|
path: "/home/{{ new_user }}/.ssh"
|
||
|
|
state: directory
|
||
|
|
mode: "0700"
|
||
|
|
owner: "{{ new_user }}"
|
||
|
|
group: "{{ new_user }}"
|
||
|
|
|
||
|
|
- name: Change SSH port and disable root login
|
||
|
|
lineinfile:
|
||
|
|
path: /etc/ssh/sshd_config
|
||
|
|
regexp: "{{ item.regexp }}"
|
||
|
|
line: "{{ item.line }}"
|
||
|
|
state: present
|
||
|
|
backrefs: yes
|
||
|
|
loop:
|
||
|
|
- { regexp: "^#?Port .*", line: "Port {{ ssh_port }}" }
|
||
|
|
- { regexp: "^#?PermitRootLogin .*", line: "PermitRootLogin no" }
|
||
|
|
- {
|
||
|
|
regexp: "^#?PasswordAuthentication .*",
|
||
|
|
line: "PasswordAuthentication no",
|
||
|
|
}
|
||
|
|
|
||
|
|
- name: Restart SSH
|
||
|
|
service:
|
||
|
|
name: ssh
|
||
|
|
state: restarted
|
||
|
|
|
||
|
|
- name: Set SSH port to new port
|
||
|
|
set_fact:
|
||
|
|
ansible_port: "{{ ssh_port }}"
|
||
|
|
|
||
|
|
- name: Install UFW
|
||
|
|
apt:
|
||
|
|
name: ufw
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Turn UFW off
|
||
|
|
ufw:
|
||
|
|
state: disabled
|
||
|
|
|
||
|
|
- name: Configure UFW default rules
|
||
|
|
ufw:
|
||
|
|
policy: deny
|
||
|
|
direction: incoming
|
||
|
|
|
||
|
|
- name: Allow outgoing traffic
|
||
|
|
ufw:
|
||
|
|
rule: allow
|
||
|
|
direction: outgoing
|
||
|
|
|
||
|
|
- name: Allow SSH port through UFW
|
||
|
|
ufw:
|
||
|
|
rule: allow
|
||
|
|
port: "{{ ssh_port }}"
|
||
|
|
proto: tcp
|
||
|
|
from_ip: "{{ allow_ssh_from if allow_ssh_from != 'any' else omit }}"
|
||
|
|
|
||
|
|
- name: Turn UFW on
|
||
|
|
ufw:
|
||
|
|
state: enabled
|
||
|
|
|
||
|
|
- name: Install fail2ban
|
||
|
|
apt:
|
||
|
|
name: fail2ban
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Ensure fail2ban is running
|
||
|
|
service:
|
||
|
|
name: fail2ban
|
||
|
|
enabled: yes
|
||
|
|
state: started
|
||
|
|
|
||
|
|
- name: Remove unnecessary services
|
||
|
|
apt:
|
||
|
|
name: "{{ item }}"
|
||
|
|
state: absent
|
||
|
|
purge: yes
|
||
|
|
loop:
|
||
|
|
- exim4
|
||
|
|
- apache2
|
||
|
|
- cups
|
||
|
|
- rpcbind
|
||
|
|
- nfs-common
|
||
|
|
- telnet
|
||
|
|
- ftp
|
||
|
|
- samba
|
||
|
|
|
||
|
|
- name: Install auditd
|
||
|
|
apt:
|
||
|
|
name:
|
||
|
|
- auditd
|
||
|
|
- audispd-plugins
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Enable and start auditd
|
||
|
|
service:
|
||
|
|
name: auditd
|
||
|
|
enabled: yes
|
||
|
|
state: started
|