autopassword.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+key=hello
+name=$1
+hash=$(echo -n "$name$key" | sha256sum | xxd -r -p | base64 | tr -d '+/')
+echo "${hash:0:8}-${hash:8:8}"

handlers.yml

@@ -1,2 +1,3 @@
 - name: restart ufw
   service: name=ufw state=restarted
+  become: yes

hosts

@@ -0,0 +1,17 @@
+[forensics]
+10.8.2.12 ansible_user=administrator
+
+[database]
+10.8.2.3 ansible_user=administrator
+
+[workstations]
+10.8.1.10 ansible_user=administrator
+10.8.1.40 ansible_user=administrator
+
+[workstations:children]
+web
+
+[web]
+10.8.1.90 ansible_user=administrator
+
+

roles/database/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Allow MySQL traffic
+  ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
+  with_items:
+    - { rule: 'allow', port: '3306', proto: 'tcp' }
+  notify:
+    - restart ufw
+  become: yes

roles/immortal/handlers/main.yml

@@ -0,0 +1,3 @@
+- name: restart ufw
+  service: name=ufw state=restarted
+  become: yes

roles/immortal/tasks/main.yml

@@ -1,13 +1,14 @@
 ---
-- name: Generate password
+# - name: Generate password
-  delegate_to: localhost
+#   delegate_to: localhost
-  shell: bash autopassword.sh {{ inventory_hostname }}
+#   shell: bash autopassword.sh {{ inventory_hostname }}
-  register: genPass 
+#   register: genPass 
     
 - name: Backup ssh config
   fetch:
     src: /etc/ssh/sshd_config
     dest: "{{ inventory_hostname }}" 
+  become: yes 
 
 - name: Backup os-release
   fetch:
@@ -19,12 +20,58 @@
     src: /etc/passwd
     dest: "{{ inventory_hostname }}"
 
+- name: Collect disk space data
+  block:
+    - name: lsblk
+      shell: lsblk
+      register: lsblk_output
+      become: yes
+    - name: Store results
+      copy:
+        content: "{{lsblk_output.stdout}}"
+        dest: "{{ inventory_hostname }}/lsblk.out"
+      delegate_to: localhost
+      become: no
+
+- name: Collect netstat
+  block:
+    - name: Run command
+      shell: netstat -peanut
+      register: netstat_output
+      become: yes
+    - name: Store results
+      copy:
+        content: "{{netstat_output.stdout}}"
+        dest: "{{ inventory_hostname }}/netstat.out"
+      delegate_to: localhost
+      become: no
+- name: Collect process data
+  block:
+    - name: Run command
+      shell: ps aux
+      register: ps_output
+      become: yes
+    - name: Store results
+      copy:
+        content: "{{ps_output.stdout}}"
+        dest: "{{ inventory_hostname }}/ps.out"
+      delegate_to: localhost
+      become: no
 - name: Get users
   get_users:
-    min_uid: {{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}
+    #min_uid: "{{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}"
+    min_uid: 1000
     max_uid: 65000
+  become: yes
   register: users_list 
 
+- name: Backup all users authorized keys
+  fetch:
+    src: "{{item['dir']}}/.ssh/authorized_keys"
+    dest: "{{ inventory_hostname }}"
+  ignore_errors: yes
+  loop: "{{ users_list.users }}"
+
 - name: Give root exclusively the current controller user's SSH key
   ansible.posix.authorized_key:
     user: root
@@ -33,21 +80,39 @@
     exclusive: yes
   become: yes
 
+
 - name: Give all users exclusively the current controller user's SSH key
   ansible.posix.authorized_key:
-    user: {{item}}
+    user: "{{item['name']}}"
     state: present
     key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
     exclusive: yes
   become: yes
   loop: "{{ users_list.users }}"
 
-- name: Ensure UFW is installed
+- block:
+    - name: Ensure EPEL if RHEL based
+      yum:
+        name: epel-release
+        state: present
+      when: ansible_os_family == "RedHat"
+
+    - name: Disable firewalld if RHEL based
+      shell: "systemctl disable firewalld; systemctl stop firewalld"
+      when: ansible_os_family == "RedHat"
+      
+    - name: Ensure UFW is installed
       package:
         name: ufw
         state: present
 
-- name: Configure ufw defaults
+    - name: Ensure UFW is disabled
+      ufw: state=disabled
+    
+    - name: Reset UFW
+      ufw: state=reset
+
+    - name: Configure ufw defaults
       ufw: direction={{ item.direction }} policy={{ item.policy }}
       with_items:
         - { direction: 'incoming', policy: 'deny' }
@@ -55,30 +120,30 @@
       notify:
         - restart ufw
 
-- name: Configure ufw rules
+    - name: Configure ufw rules
       ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
       with_items:
         - { rule: 'limit', port: '22', proto: 'tcp' }
       notify:
         - restart ufw
 
-- name: Enable ufw logging
+    - name: Enable ufw logging
       ufw: logging=on
       notify:
         - restart ufw
 
-- name: Enable ufw
+    - name: Enable ufw
       ufw: state=enabled
     
-- name: Change root password
+    - name: Change root password
       user:
         name: root
         shell: /bin/bash
-    password: "{{ genPass.stdout | password_hash('sha512') }}"
+        password: "{{ password | password_hash('sha512') }}"
 
-- name: Change admin password
+    - name: Change admin password
       user:
         name: "{{ ansible_user }}"
         shell: /bin/bash
-    password: "{{ genPass.stdout | password_hash('sha512') }}"         
+        password: "{{ password | password_hash('sha512') }}"         
-
+  become: yes  

roles/web/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Allow Web traffic
+  ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
+  with_items:
+    - { rule: 'allow', port: '80', proto: 'tcp' }
+  notify:
+    - restart ufw
+  become: yes

setup.yml

@@ -1,4 +1,35 @@
 ---
-hosts: all
+
-roles:
+- hosts: all
+  handlers:
+    - import_tasks: handlers.yml
+  vars_prompt:
+    - name: password
+      prompt: "Enter new root and admin password"
+  roles:
    - immortal
+  become: yes
+
+- hosts: web
+  handlers:
+    - import_tasks: handlers.yml
+  roles:
+    - web
+  become: yes
+
+- hosts: database
+  handlers:
+    - import_tasks: handlers.yml
+  roles:
+    - database
+  become: yes
+
+- hosts: all
+  vars:
+    pip_install_packages:
+      - name: docker
+
+  roles:
+    - geerlingguy.pip
+    - geerlingguy.docker
+  become: yes