Skip to content

Commit 9b02f43

Browse files
author
sysadt
authored
Init
1 parent 995a059 commit 9b02f43

File tree

17 files changed

+553
-0
lines changed

17 files changed

+553
-0
lines changed

‎group_vars/variables.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
sshpub_location: SSH_PUBKEY_HERE #the full path to your SSH public key ( e.g. /Users/username/.ssh/id_ed25519.pub )
2+
root_pw: "PASSWORD_HERE" #root password that should be set
3+
user_name: USERNAME_HERE #username for the created user
4+
user_pw: "PASSWORD_HERE" #password for the new user
5+
ssh_port: 55899 #port number for ssh
6+
mail_to: [email protected] #the mail address where mails should be sent to
7+
mail_from: [email protected] #the mail address where mails are sent from
8+
mail_smtp_server: smtp.example.com #mail server, e.g. smtp.gmail.com
9+
mail_pw: PASSWORD_HERE #password for the mail_from mail address
10+
mail_port: 587 #the port where mails are sent to the mail server, e.g. 587
11+

‎hosts.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[debian-server]
2+
SERVER-IPADDRESS-HERE

‎main-playbook.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
- name: Main-Playbook
2+
hosts: debian-server
3+
remote_user: "{{ user_name }}"
4+
gather_facts: yes
5+
vars_files: ./group_vars/variables.yml
6+
7+
roles:
8+
- packages
9+
- ssh
10+
- password-quality
11+
- unattended-upgrades
12+
- firewall
13+
- mail
14+
- clamav
15+
- rkhunter
16+
- auditd
17+
- lynis

‎requirements-playbook.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
- name: Requirements-Playbook
2+
hosts: debian-server
3+
remote_user: root
4+
vars_files: ./group_vars/variables.yml
5+
6+
roles:
7+
- requirements

‎roles/auditd/tasks/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
- name: remove default auditd rules and download best practice rules
3+
become: true
4+
shell: |
5+
rm /etc/audit/rules.d/audit.rules
6+
wget -P /etc/audit/rules.d/ https://raw.githubusercontent.com/Neo23x0/auditd/master/audit.rules
7+
service auditd restart
8+

‎roles/clamav/tasks/main.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
2+
- name: set cron MAILTO
3+
become: true
4+
cronvar:
5+
user: root
6+
name: MAILTO
7+
value: "{{ mail_to }}"
8+
9+
- name: add crontab to run clamav daily at 3 AM
10+
become: true
11+
cron:
12+
name: clamav daily run
13+
minute: "0"
14+
hour: "3"
15+
job: "/usr/bin/clamscan -ri --exclude-dir=\"^/sys\" --no-summary /"
16+
user: root

‎roles/firewall/handlers/main.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
- name: restart ufw service
2+
become: yes
3+
service:
4+
name: ufw
5+
state: restarted
6+
7+
- name: restart psad service
8+
become: yes
9+
service:
10+
name: psad
11+
state: restarted
12+
13+
- name: restart fail2ban service
14+
become: yes
15+
service:
16+
name: fail2ban
17+
state: restarted

‎roles/firewall/tasks/main.yml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
2+
- name: default config for ufw
3+
become: true
4+
ufw:
5+
state: enabled
6+
logging: on
7+
notify: restart ufw service
8+
9+
- name: ufw - default deny in
10+
become: true
11+
ufw:
12+
policy: deny
13+
direction: incoming
14+
notify: restart ufw service
15+
16+
- name: ufw - default deny out
17+
become: true
18+
ufw:
19+
policy: deny
20+
direction: outgoing
21+
notify: restart ufw service
22+
23+
- name: ufw - configure ssh rule
24+
become: true
25+
ufw:
26+
rule: limit
27+
direction: in
28+
to_port: "{{ ssh_port }}"
29+
notify: restart ufw service
30+
31+
- name: ufw - allow outgoing ports
32+
become: true
33+
ufw:
34+
rule: allow
35+
direction: out
36+
to_port: "{{ item }}"
37+
with_items:
38+
- "53"
39+
- "123"
40+
- "80"
41+
- "443"
42+
- "{{ mail_port }}" #outgoing mail port
43+
notify: restart ufw service
44+
45+
- name: configure psad
46+
become: true
47+
lineinfile:
48+
dest: /etc/psad/psad.conf
49+
regexp: "{{ item.regexp }}"
50+
line: "{{ item.line }}"
51+
loop:
52+
- { regexp: '^EMAIL_ADDRESSES', line: 'EMAIL_ADDRESSES {{ mail_to }};' }
53+
- { regexp: '^EXPECT_TCP_OPTIONS', line: 'EXPECT_TCP_OPTIONS Y;'}
54+
- { regexp: '^ENABLE_PSADWATCHD', line: 'ENABLE_PSADWATCHD Y;'}
55+
- { regexp: '^ENABLE_AUTO_IDS ', line: 'ENABLE_AUTO_IDS Y;'}
56+
- { regexp: '^ENABLE_AUTO_IDS_EMAILS', line: 'ENABLE_AUTO_IDS_EMAILS Y;'}
57+
- { regexp: '^AUTO_IDS_DANGER_LEVEL', line: 'AUTO_IDS_DANGER_LEVEL 3;'}
58+
- { regexp: '^HOSTNAME', line: 'HOSTNAME {{ ansible_hostname }};'}
59+
notify: restart psad service
60+
61+
- name: add logging to ufw before.rules
62+
become: true
63+
blockinfile:
64+
dest: /etc/ufw/before.rules
65+
insertbefore: "COMMIT"
66+
marker: "# {mark} ANSIBLE MANAGED BLOCK"
67+
block: |
68+
# log all traffic so psad can analyze
69+
-A INPUT -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
70+
-A FORWARD -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
71+
notify: restart ufw service
72+
73+
- name: add logging to ufw before6.rules
74+
become: true
75+
blockinfile:
76+
dest: /etc/ufw/before6.rules
77+
insertbefore: "COMMIT"
78+
marker: "# {mark} ANSIBLE MANAGED BLOCK"
79+
block: |
80+
# log all traffic so psad can analyze
81+
-A INPUT -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
82+
-A FORWARD -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
83+
notify: restart ufw service
84+
85+
- name: update psad signatures
86+
become: true
87+
shell: |
88+
psad --sig-update
89+
90+
- name: configure fail2ban
91+
become: true
92+
blockinfile:
93+
path: /etc/fail2ban/jail.local
94+
block: |
95+
[DEFAULT]
96+
# the IP address range we want to ignore
97+
ignoreip = 127.0.0.1/8
98+
99+
# who to send e-mail to
100+
destemail = {{ mail_to }}
101+
102+
# who is the email from
103+
sender = {{ mail_from }}
104+
105+
# since we're using exim4 to send emails
106+
mta = mail
107+
108+
# get email alerts
109+
action = %(action_mwl)s
110+
create: true
111+
notify: restart fail2ban service
112+
113+
- name: fail2ban - configure ssh jail
114+
become: true
115+
blockinfile:
116+
path: /etc/fail2ban/jail.d/ssh.local
117+
block: |
118+
[sshd]
119+
enabled = true
120+
banaction = ufw
121+
port = {{ ssh_port }}
122+
filter = sshd
123+
logpath = %(sshd_log)s
124+
maxretry = 5
125+
create: true
126+
notify: restart fail2ban service
127+

‎roles/lynis/tasks/main.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
- name: prepare lynis installation
2+
become: true
3+
shell: |
4+
wget -O - https://packages.cisofy.com/keys/cisofy-software-public.key | sudo apt-key add -
5+
echo "deb https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list
6+
7+
- name: update and upgrade
8+
become: true
9+
apt:
10+
update_cache: yes
11+
upgrade: yes
12+
13+
- name: install lynis
14+
become: true
15+
apt:
16+
name: lynis
17+
state: present
18+
19+
- name: update and run first lynis audit
20+
become: true
21+
shell: |
22+
lynis update info
23+
lynis audit system | ansi2html -l > /tmp/lynis-report.html
24+
echo "First Lynis report see attachment" | mail -A /tmp/lynis-report.html -s "Lynis report" {{ mail_to }}

‎roles/mail/tasks/main.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
2+
- name: configure mail settings
3+
become: true
4+
blockinfile:
5+
path: /etc/msmtprc
6+
block: |
7+
defaults
8+
port {{ mail_port }}
9+
tls on
10+
tls_trust_file /etc/ssl/certs/ca-certificates.crt
11+
account {{ mail_from }}
12+
host {{ mail_smtp_server }}
13+
set_from_header on
14+
from {{ mail_from }}
15+
auth on
16+
user {{ mail_from }}
17+
password {{ mail_pw }}
18+
account default: {{ mail_from }}
19+
aliases /etc/aliases
20+
logfile /var/log/msmtp
21+
create: true
22+
23+
- name: chmod mail config file
24+
become: true
25+
file:
26+
path: /etc/msmtprc
27+
group: msmtp
28+
mode: '640'
29+
30+
- name: configure mail settings pt. 2
31+
become: true
32+
lineinfile:
33+
dest: /etc/aliases
34+
regexp: "{{ item.regexp }}"
35+
line: "{{ item.line }}"
36+
create: true
37+
loop:
38+
- { regexp: '^root:', line: 'root: {{ mail_to }}' }
39+
- { regexp: '^default:', line: 'default: {{ mail_to }}' }
40+
41+
- name: configure mail settings pt. 3
42+
become: true
43+
lineinfile:
44+
path: /etc/mail.rc
45+
regexp: '^set sendmail'
46+
line: 'set sendmail="/usr/bin/msmtp -t"'
47+
create: yes
48+
49+
- name: send a testmail
50+
become: true
51+
shell: echo "Testmail content" | mail -s "Testmail subject" {{ mail_to }}

0 commit comments

Comments
 (0)