Add reusable Debian and Ubuntu hardening playbooks

2026-09-29 00:07:10 +04:00
commit 3d08c8f1ff
17 changed files with 663 additions and 0 deletions
@@ -0,0 +1,32 @@
+---
+- name: Read-only host discovery
+  hosts: debian_servers
+  gather_facts: true
+
+  tasks:
+    - name: Show platform facts
+      ansible.builtin.debug:
+        msg:
+          - "Host: {{ inventory_hostname }} ({{ ansible_host | default(inventory_hostname) }})"
+          - "Distribution: {{ ansible_distribution }} {{ ansible_distribution_version }}"
+          - "Kernel: {{ ansible_kernel }}"
+          - "Architecture: {{ ansible_architecture }}"
+          - "Memory: {{ ansible_memtotal_mb }} MiB"
+          - "Default interface: {{ ansible_default_ipv4.interface | default('unknown') }}"
+
+    - name: Read filesystem capacity
+      ansible.builtin.command: df -h /
+      register: root_fs
+      changed_when: false
+
+    - name: Read listening TCP and UDP sockets
+      ansible.builtin.command: ss -H -tulpn
+      register: listeners
+      changed_when: false
+      become: true
+
+    - name: Report non-secret discovery results
+      ansible.builtin.debug:
+        msg:
+          filesystem: "{{ root_fs.stdout_lines }}"
+          listeners: "{{ listeners.stdout_lines }}"