ansible-common/roles/secure/tasks/main.yml

105 lines
2.5 KiB
YAML

---
# roles/common_secure/tasks/main.yml
- name: Upgrade system packages
ansible.builtin.apt:
update_cache: true
upgrade: full
when: common_full_upgrade
- name: Install UFW Firewall
ansible.builtin.apt:
name: ufw
# update_cache: true
state: present
when: common_firewall_enable
- name: Enable UFW
community.general.ufw:
state: enabled
logging: 'on'
when: common_firewall_enable
- name: Disable UFW Firewall
ansible.builtin.apt:
name: ufw
state: absent
when: not common_firewall_enable
- name: Reject incoming connections by default
community.general.ufw:
policy: reject
comment: 'Reject all by default'
when: common_firewall_reject and common_firewall_enable
- name: Allow SSH Connections
community.general.ufw:
rule: limit
port: ssh
proto: tcp
comment: 'Allow SSH'
when: common_firewall_ssh and common_firewall_enable
- name: Allow HTTPS Connections
community.general.ufw:
rule: allow
port: https
proto: tcp
comment: 'Allow HTTPS'
when: common_firewall_https and common_firewall_enable
- name: Allow HTTP Connections
community.general.ufw:
rule: allow
port: http
proto: tcp
comment: 'Allow HTTP'
when: common_firewall_http and common_firewall_enable
- name: Install sudo
ansible.builtin.apt:
pkg: sudo
update_cache: true
state: present
- name: Configure SSH to disallow passwords
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "{{ ssh_config_entry.regexp }}"
line: "{{ ssh_config_entry.line }}"
state: present
loop:
- { regexp: '^PasswordAuthentication', line: 'PasswordAuthentication no' }
loop_control:
loop_var: ssh_config_entry
notify: restart ssh
when: common_ssh_configure
- name: Add authorized ssh keys for root
ansible.posix.authorized_key:
user: root
state: present
key: "{{ lookup('file', ssh_key_file) }}"
loop: "{{ query('fileglob', '../files/*') }}"
loop_control:
loop_var: ssh_key_file
- name: Lock the root account
ansible.builtin.user:
name: root
password_lock: "{{ 'no' if common_lock_root is defined and not common_lock_root else 'yes' }}"
# - name: Configure SSH to disallow root login
# ansible.builtin.lineinfile:
# path: /etc/ssh/sshd_config
# regexp: '^PermitRootLogin'
# line: 'PermitRootLogin no'
# state: present
# notify: restart ssh
# when: common_ssh_configure
# - name: Disable root shell
# ansible.builtin.user:
# name: root
# shell: /usr/sbin/nologin
# when: common_disable_root