59 lines
1.5 KiB
YAML
59 lines
1.5 KiB
YAML
---
|
|
- name: Install ufw and fail2ban
|
|
ansible.builtin.apt:
|
|
name:
|
|
- ufw
|
|
- fail2ban
|
|
state: present
|
|
|
|
- name: Harden sshd_config - PermitRootLogin
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin {{ ssh_permit_root_login }}"
|
|
notify: Restart sshd
|
|
|
|
- name: Harden sshd_config - PasswordAuthentication
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication {{ ssh_password_authentication }}"
|
|
notify: Restart sshd
|
|
|
|
- name: Set sshd Port
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?Port"
|
|
line: "Port {{ ssh_port }}"
|
|
notify: Restart sshd
|
|
|
|
- name: Reset ufw defaults (deny incoming, allow outgoing)
|
|
community.general.ufw:
|
|
state: reset
|
|
changed_when: false
|
|
|
|
- name: Set ufw default policies
|
|
community.general.ufw:
|
|
direction: "{{ item.direction }}"
|
|
policy: "{{ item.policy }}"
|
|
loop:
|
|
- { direction: incoming, policy: deny }
|
|
- { direction: outgoing, policy: allow }
|
|
|
|
- name: Allow required TCP ports through ufw
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop: "{{ (ufw_allowed_tcp_ports + ufw_allowed_tcp_ports_extra) | unique }}"
|
|
|
|
- name: Enable ufw
|
|
community.general.ufw:
|
|
state: enabled
|
|
|
|
- name: Ensure fail2ban is running and enabled
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|