autopassword.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-key=hello
-name=$1
-hash=$(echo -n "$name$key" | sha256sum | xxd -r -p | base64 | tr -d '+/')
-echo "${hash:0:8}-${hash:8:8}"

handlers.yml

@@ -1,3 +1,2 @@
 - name: restart ufw
   service: name=ufw state=restarted
-  become: yes

hosts

@@ -1,17 +0,0 @@
-[forensics]
-10.8.2.12 ansible_user=administrator
-
-[database]
-10.8.2.3 ansible_user=administrator
-
-[workstations]
-10.8.1.10 ansible_user=administrator
-10.8.1.40 ansible_user=administrator
-
-[workstations:children]
-web
-
-[web]
-10.8.1.90 ansible_user=administrator
-
-

roles/database/tasks/main.yml

@@ -1,8 +0,0 @@
----
-- name: Allow MySQL traffic
-  ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
-  with_items:
-    - { rule: 'allow', port: '3306', proto: 'tcp' }
-  notify:
-    - restart ufw
-  become: yes

roles/immortal/handlers/main.yml

@@ -1,3 +0,0 @@
-- name: restart ufw
-  service: name=ufw state=restarted
-  become: yes

roles/immortal/tasks/main.yml

@@ -1,14 +1,13 @@
 ---
-# - name: Generate password
+- name: Generate password
-#   delegate_to: localhost
+  delegate_to: localhost
-#   shell: bash autopassword.sh {{ inventory_hostname }}
+  shell: bash autopassword.sh {{ inventory_hostname }}
-#   register: genPass 
+  register: genPass 
     
 - name: Backup ssh config
   fetch:
     src: /etc/ssh/sshd_config
     dest: "{{ inventory_hostname }}"  
-  become: yes 
 
 - name: Backup os-release
   fetch:
@@ -20,58 +19,12 @@
     src: /etc/passwd
     dest: "{{ inventory_hostname }}"
 
-- name: Collect disk space data
-  block:
-    - name: lsblk
-      shell: lsblk
-      register: lsblk_output
-      become: yes
-    - name: Store results
-      copy:
-        content: "{{lsblk_output.stdout}}"
-        dest: "{{ inventory_hostname }}/lsblk.out"
-      delegate_to: localhost
-      become: no
-
-- name: Collect netstat
-  block:
-    - name: Run command
-      shell: netstat -peanut
-      register: netstat_output
-      become: yes
-    - name: Store results
-      copy:
-        content: "{{netstat_output.stdout}}"
-        dest: "{{ inventory_hostname }}/netstat.out"
-      delegate_to: localhost
-      become: no
-- name: Collect process data
-  block:
-    - name: Run command
-      shell: ps aux
-      register: ps_output
-      become: yes
-    - name: Store results
-      copy:
-        content: "{{ps_output.stdout}}"
-        dest: "{{ inventory_hostname }}/ps.out"
-      delegate_to: localhost
-      become: no
 - name: Get users
   get_users:
-    #min_uid: "{{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}"
+    min_uid: {{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}
-    min_uid: 1000
     max_uid: 65000
-  become: yes
     register: users_list
 
-- name: Backup all users authorized keys
-  fetch:
-    src: "{{item['dir']}}/.ssh/authorized_keys"
-    dest: "{{ inventory_hostname }}"
-  ignore_errors: yes
-  loop: "{{ users_list.users }}"
-
 - name: Give root exclusively the current controller user's SSH key
   ansible.posix.authorized_key:
     user: root
@@ -80,39 +33,21 @@
     exclusive: yes
     become: yes
 
-
 - name: Give all users exclusively the current controller user's SSH key
   ansible.posix.authorized_key:
-    user: "{{item['name']}}"
+    user: {{item}}
     state: present
     key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
     exclusive: yes
     become: yes
     loop: "{{ users_list.users }}"
 
-- block:
+- name: Ensure UFW is installed
-    - name: Ensure EPEL if RHEL based
-      yum:
-        name: epel-release
-        state: present
-      when: ansible_os_family == "RedHat"
-
-    - name: Disable firewalld if RHEL based
-      shell: "systemctl disable firewalld; systemctl stop firewalld"
-      when: ansible_os_family == "RedHat"
-      
-    - name: Ensure UFW is installed
   package:
     name: ufw
     state: present
 
-    - name: Ensure UFW is disabled
+- name: Configure ufw defaults
-      ufw: state=disabled
-    
-    - name: Reset UFW
-      ufw: state=reset
-
-    - name: Configure ufw defaults
   ufw: direction={{ item.direction }} policy={{ item.policy }}
   with_items:
     - { direction: 'incoming', policy: 'deny' }
@@ -120,30 +55,30 @@
   notify:
     - restart ufw
 
-    - name: Configure ufw rules
+- name: Configure ufw rules
   ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
   with_items:
     - { rule: 'limit', port: '22', proto: 'tcp' }
   notify:
     - restart ufw
 
-    - name: Enable ufw logging
+- name: Enable ufw logging
   ufw: logging=on
   notify:
     - restart ufw
 
-    - name: Enable ufw
+- name: Enable ufw
   ufw: state=enabled
 
-    - name: Change root password
+- name: Change root password
   user:
     name: root
     shell: /bin/bash
-        password: "{{ password | password_hash('sha512') }}"
+    password: "{{ genPass.stdout | password_hash('sha512') }}"
 
-    - name: Change admin password
+- name: Change admin password
   user:
     name: "{{ ansible_user }}"
     shell: /bin/bash
-        password: "{{ password | password_hash('sha512') }}"         
+    password: "{{ genPass.stdout | password_hash('sha512') }}"         
-  become: yes  
+

roles/web/tasks/main.yml

@@ -1,8 +0,0 @@
----
-- name: Allow Web traffic
-  ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
-  with_items:
-    - { rule: 'allow', port: '80', proto: 'tcp' }
-  notify:
-    - restart ufw
-  become: yes

setup.yml

@@ -1,35 +1,4 @@
 ---
-
+hosts: all
-- hosts: all
+roles:
-  handlers:
-    - import_tasks: handlers.yml
-  vars_prompt:
-    - name: password
-      prompt: "Enter new root and admin password"
-  roles:
   - immortal
-  become: yes
-
-- hosts: web
-  handlers:
-    - import_tasks: handlers.yml
-  roles:
-    - web
-  become: yes
-
-- hosts: database
-  handlers:
-    - import_tasks: handlers.yml
-  roles:
-    - database
-  become: yes
-
-- hosts: all
-  vars:
-    pip_install_packages:
-      - name: docker
-
-  roles:
-    - geerlingguy.pip
-    - geerlingguy.docker
-  become: yes