Remove mistakenly pushed file
This commit is contained in:
parent
65dd8043de
commit
e2e1462c4e
|
@ -1,120 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- name: Security hardening
|
|
||||||
hosts: all
|
|
||||||
roles:
|
|
||||||
- fail2ban_role
|
|
||||||
become: true
|
|
||||||
|
|
||||||
vars:
|
|
||||||
fail2ban_services: sshd
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Disable Password Authentication
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: '^#?PasswordAuthentication'
|
|
||||||
line: 'PasswordAuthentication no'
|
|
||||||
state: present
|
|
||||||
backup: yes
|
|
||||||
validate: /usr/bin/sshd -t -f %s
|
|
||||||
notify: Restart ssh
|
|
||||||
when: false
|
|
||||||
|
|
||||||
- name: Disable root login
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: '^#?PasswordAuthentication'
|
|
||||||
line: 'PasswordAuthentication no'
|
|
||||||
state: present
|
|
||||||
backup: yes
|
|
||||||
validate: /usr/bin/sshd -t -f %s
|
|
||||||
notify: Restart ssh
|
|
||||||
when: false
|
|
||||||
|
|
||||||
- name: Disable Empty Passwords
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: '^#?PasswordAuthentication'
|
|
||||||
line: 'PasswordAuthentication no'
|
|
||||||
state: present
|
|
||||||
backup: yes
|
|
||||||
validate: /usr/bin/sshd -t -f %s
|
|
||||||
notify: Restart ssh
|
|
||||||
|
|
||||||
#passwordless login
|
|
||||||
- name: Copy SSH public key
|
|
||||||
authorized_key:
|
|
||||||
user: your_remote_user
|
|
||||||
state: present
|
|
||||||
key: "{{ lookup('file', '~/.ssh/ansible_key.pub') }}"
|
|
||||||
manager_dir: yes
|
|
||||||
|
|
||||||
#Set up fail2ban
|
|
||||||
- name: Install Fail2ban
|
|
||||||
package:
|
|
||||||
name: fail2ban
|
|
||||||
state: present
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: configure Fail2ban
|
|
||||||
template:
|
|
||||||
src: jail.local.j2
|
|
||||||
dest: /etc/fail2ban/jail.local
|
|
||||||
become: true
|
|
||||||
notify: Restart Fail2ban
|
|
||||||
|
|
||||||
- name: Ensure Fail2ban service is started and enabled
|
|
||||||
service:
|
|
||||||
name: fail2ban
|
|
||||||
state: started
|
|
||||||
enabled: true
|
|
||||||
become: true
|
|
||||||
|
|
||||||
#Configure Firewall UFW
|
|
||||||
- name: Ensure UFW is installed
|
|
||||||
package:
|
|
||||||
name: ufw
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Ensure UFW is enabled
|
|
||||||
community.general.ufw:
|
|
||||||
state: enabled
|
|
||||||
policy: deny
|
|
||||||
direction: incoming
|
|
||||||
|
|
||||||
- name: Allow SSH connections
|
|
||||||
community.general.ufw:
|
|
||||||
rule: allow
|
|
||||||
name: OpenSSH
|
|
||||||
|
|
||||||
- name: Allow HTTP connections
|
|
||||||
community.general.ufw:
|
|
||||||
rule: allow
|
|
||||||
port: '80'
|
|
||||||
proto: tcp
|
|
||||||
|
|
||||||
- name: Reload UFW
|
|
||||||
community.general.ufw:
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
# Set file permission
|
|
||||||
- name: Set file permission
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /home/adelya/tes.txt
|
|
||||||
mode: '0644'
|
|
||||||
owner: adel
|
|
||||||
group: pkl
|
|
||||||
state: file
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Restart SSH
|
|
||||||
service:
|
|
||||||
name: sshd
|
|
||||||
state: restarted
|
|
||||||
|
|
||||||
- name: Restart Fail2ban
|
|
||||||
service:
|
|
||||||
name: fail2ban
|
|
||||||
state: restarted
|
|
||||||
become: true
|
|
Loading…
Reference in New Issue