53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
---
|
|
- name: Apply operating-system, SSH, Fail2ban, and UFW hardening
|
|
hosts: debian_servers
|
|
become: true
|
|
gather_facts: true
|
|
serial: 1
|
|
|
|
pre_tasks:
|
|
- name: Require a supported Debian or Ubuntu system
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_distribution in ["Debian", "Ubuntu"]
|
|
- ansible_service_mgr == "systemd"
|
|
fail_msg: >-
|
|
This playbook targets Debian or Ubuntu hosts using systemd. Review
|
|
the inventory and platform facts before applying it elsewhere.
|
|
|
|
- name: Confirm UFW is configured to preserve the current SSH path
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_port | default(22) | int == ssh_port | int or (ssh_keep_legacy_port | bool and ansible_port | default(22) | int == ssh_legacy_port | int)
|
|
fail_msg: >-
|
|
Keep the current Ansible connection port in sshd and UFW during the
|
|
first run. After confirming the new port works, update ansible_port
|
|
and rerun with ssh_keep_legacy_port=false.
|
|
|
|
roles:
|
|
- role: baseline
|
|
tags: [baseline]
|
|
- role: hardening
|
|
tags: [hardening, ssh, fail2ban, ufw]
|
|
|
|
handlers:
|
|
- name: Restart active SSH socket after reloading systemd
|
|
ansible.builtin.systemd_service:
|
|
name: ssh.socket
|
|
daemon_reload: true
|
|
state: restarted
|
|
listen: Apply SSH changes
|
|
when: hardening_ssh_socket.rc == 0
|
|
|
|
- name: Reload ssh
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: reloaded
|
|
listen: Apply SSH changes
|
|
when: hardening_ssh_socket.rc != 0 or hardening_ssh_service.rc == 0
|
|
|
|
- name: Restart fail2ban
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
state: restarted
|