ssh-remote-server-setup/playbook.yml at main · RafaelQSantos-RQS/ssh-remote-server-setup · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
---
- name: Configurar servidor SSH
  hosts: all
  become: true

  tasks:
    - name: Atualizar cache do apt
      ansible.builtin.apt:
        update_cache: true

    - name: Instalar OpenSSH Server e Fail2ban
      ansible.builtin.apt:
        name:
          - openssh-server
          - fail2ban
        state: present

    - name: Garantir que o serviço SSH está rodando
      ansible.builtin.service:
        name: ssh
        state: started
        enabled: true

    - name: Configurar SSH para permitir autenticação por chave
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PubkeyAuthentication'
        line: 'PubkeyAuthentication yes'
        state: present
      notify: Reiniciar SSH

    - name: Configurar SSH para desabilitar autenticação por senha
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present
      notify: Reiniciar SSH

    - name: Garantir que o serviço Fail2ban está rodando
      ansible.builtin.service:
        name: fail2ban
        state: started
        enabled: true

    - name: Configurar Fail2ban para SSH
      ansible.builtin.copy:
        dest: /etc/fail2ban/jail.d/sshd.local
        content: |
          [sshd]
          enabled = true
          port = ssh
          filter = sshd
          logpath = /var/log/auth.log
          maxretry = 3
          bantime = 3600
          findtime = 600
        mode: '0644'
      notify: Reiniciar Fail2ban

    - name: Criar diretório .ssh para usuário vagrant
      ansible.builtin.file:
        path: /home/vagrant/.ssh
        state: directory
        mode: '0700'
        owner: vagrant
        group: vagrant

    - name: Adicionar primeira chave SSH pública
      ansible.posix.authorized_key:
        user: vagrant
        key: "{{ lookup('file', 'keys/key1.pub') }}"
        state: present

    - name: Adicionar segunda chave SSH pública
      ansible.posix.authorized_key:
        user: vagrant
        key: "{{ lookup('file', 'keys/key2.pub') }}"
        state: present

  handlers:
    - name: Reiniciar SSH
      ansible.builtin.service:
        name: ssh
        state: restarted

    - name: Reiniciar Fail2ban
      ansible.builtin.service:
        name: fail2ban
        state: restarted