-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathharden-server.yml
139 lines (129 loc) · 3.64 KB
/
harden-server.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
# https://www.redhat.com/sysadmin/ansible-linux-server-security
- name: Harden server
hosts: all
become: true
remote_user: "{{ user }}"
handlers:
- name: Reload firewalld
service:
name: firewalld
state: reloaded
- name: Reload SSH
service:
name: sshd
state: reloaded
tasks:
# - name: Harden kernel parameters
# ansible.posix.sysctl:
# name: "{{ item.name }}"
# value: '{{ item.value }}'
# sysctl_set: yes
# state: present
# reload: yes
# sysctl_file: /etc/sysctl.d/90-kernel.conf
# loop:
# - name: kernel.randomize_va_space
# value: 2
# - name: kernel.dmesg_restrict
# value: 1
# - name: kernel.perf_event_paranoid
# value: 2
#
# - name: Harden network parameters
# ansible.posix.sysctl:
# name: "{{ item.name }}"
# value: '{{ item.value }}'
# sysctl_set: yes
# state: present
# reload: yes
# sysctl_file: /etc/sysctl.d/90-net.conf
# loop:
# - name: net.ipv4.tcp_syncookies
# value: 1
# - name: net.ipv4.conf.default.log_martians
# value: 1
# - name: net.ipv4.conf.all.log_martians
# value: 1
# - name: net.ipv4.conf.all.accept_source_route
# value: 0
# - name: net.ipv4.conf.default.accept_source_route
# value: 0
# - name: net.ipv6.conf.all.accept_source_route
# value: 0
# - name: net.ipv6.conf.default.accept_source_route
# value: 0
#
# - name: Disable ip forwarding
# ansible.posix.sysctl:
# name: "{{ item.name }}"
# value: '{{ item.value }}'
# sysctl_set: yes
# state: present
# reload: yes
# sysctl_file: /etc/sysctl.d/90-ip.conf
# loop:
# - name: net.ipv4.ip_forward
# value: 0
# - name: net.ipv6.conf.all.forwarding
# value: 0
#
# - name: Disable ICMP echo and redirects
# ansible.posix.sysctl:
# name: "{{ item.name }}"
# value: '{{ item.value }}'
# sysctl_set: yes
# state: present
# reload: yes
# sysctl_file: /etc/sysctl.d/90-icmp.conf
# loop:
# - name: net.ipv4.icmp_echo_ignore_broadcasts
# value: 1
# - name: net.ipv4.icmp_echo_ignore_all
# value: 1
# - name: net.ipv4.conf.default.accept_redirects
# value: 0
# - name: net.ipv4.conf.all.accept_redirects
# value: 0
# - name: net.ipv6.conf.all.accept_redirects
# value: 0
# - name: net.ipv6.conf.default.accept_redirects
# value: 0
# - name: net.ipv4.conf.default.send_redirects
# value: 0
# - name: net.ipv4.conf.all.send_redirects
# value: 0
- name: Disable PasswordAuthentication
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?\s*PasswordAuthentication\s'
line: 'PasswordAuthentication no'
state: present
backup: yes
notify: Reload SSH
- name: Install Fail2Ban
dnf:
name: fail2ban
state: present
- name: Start and enable Fail2Ban
service:
name: fail2ban
state: started
enabled: true
- name: Install firewalld
dnf:
name: firewalld
state: present
- name: Start and enable firewalld
service:
name: firewalld
state: started
enabled: true
- name: Allow HTTP and HTTPS
firewalld:
service: "{{ item }}"
permanent: yes
state: enabled
with_items:
- http
- https
notify: Reload firewalld