Backup authorized keys before nuking

autopassword.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+key=hello
+name=$1
+hash=$(echo -n "$name$key" | sha256sum | xxd -r -p | base64 | tr -d '+/')
+echo "${hash:0:8}-${hash:8:8}"

handlers.yml

@@ -1,2 +1,3 @@
 - name: restart ufw
-  service: name=ufw state=restarted
+  service: name=ufw state=restarted
+  become: yes

hosts

@@ -0,0 +1,17 @@
+[forensics]
+10.8.2.12 ansible_user=administrator
+
+[database]
+10.8.2.3 ansible_user=administrator
+
+[workstations]
+10.8.1.10 ansible_user=administrator
+10.8.1.40 ansible_user=administrator
+
+[workstations:children]
+web
+
+[web]
+10.8.1.90 ansible_user=administrator
+
+

roles/database/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Allow MySQL traffic
+  ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
+  with_items:
+    - { rule: 'allow', port: '3306', proto: 'tcp' }
+  notify:
+    - restart ufw
+  become: yes

roles/immortal/handlers/main.yml

@@ -0,0 +1,3 @@
+- name: restart ufw
+  service: name=ufw state=restarted
+  become: yes

roles/immortal/tasks/main.yml

@@ -1,13 +1,14 @@
 ---
-- name: Generate password
-  delegate_to: localhost
-  shell: bash autopassword.sh {{ inventory_hostname }}
-  register: genPass 
+# - name: Generate password
+#   delegate_to: localhost
+#   shell: bash autopassword.sh {{ inventory_hostname }}
+#   register: genPass 
     
 - name: Backup ssh config
   fetch:
     src: /etc/ssh/sshd_config
-    dest: "{{ inventory_hostname }}"  
+    dest: "{{ inventory_hostname }}" 
+  become: yes 
 
 - name: Backup os-release
   fetch:
@@ -19,11 +20,57 @@
     src: /etc/passwd
     dest: "{{ inventory_hostname }}"
 
+- name: Collect disk space data
+  block:
+    - name: lsblk
+      shell: lsblk
+      register: lsblk_output
+      become: yes
+    - name: Store results
+      copy:
+        content: "{{lsblk_output.stdout}}"
+        dest: "{{ inventory_hostname }}/lsblk.out"
+      delegate_to: localhost
+      become: no
+
+- name: Collect netstat
+  block:
+    - name: Run command
+      shell: netstat -peanut
+      register: netstat_output
+      become: yes
+    - name: Store results
+      copy:
+        content: "{{netstat_output.stdout}}"
+        dest: "{{ inventory_hostname }}/netstat.out"
+      delegate_to: localhost
+      become: no
+- name: Collect process data
+  block:
+    - name: Run command
+      shell: ps aux
+      register: ps_output
+      become: yes
+    - name: Store results
+      copy:
+        content: "{{ps_output.stdout}}"
+        dest: "{{ inventory_hostname }}/ps.out"
+      delegate_to: localhost
+      become: no
 - name: Get users
   get_users:
-    min_uid: {{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}
+    #min_uid: "{{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}"
+    min_uid: 1000
     max_uid: 65000
-    register: users_list
+  become: yes
+  register: users_list 
+
+- name: Backup all users authorized keys
+  fetch:
+    src: "{{item['dir']}}/.ssh/authorized_keys"
+    dest: "{{ inventory_hostname }}"
+  ignore_errors: yes
+  loop: "{{ users_list.users }}"
 
 - name: Give root exclusively the current controller user's SSH key
   ansible.posix.authorized_key:
@@ -31,54 +78,72 @@
     state: present
     key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
     exclusive: yes
-    become: yes
+  become: yes
+
 
 - name: Give all users exclusively the current controller user's SSH key
   ansible.posix.authorized_key:
-    user: {{item}}
+    user: "{{item['name']}}"
     state: present
     key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
     exclusive: yes
-    become: yes
-    loop: "{{ users_list.users }}"
+  become: yes
+  loop: "{{ users_list.users }}"
 
-- name: Ensure UFW is installed
-  package:
-    name: ufw
-    state: present
+- block:
+    - name: Ensure EPEL if RHEL based
+      yum:
+        name: epel-release
+        state: present
+      when: ansible_os_family == "RedHat"
 
-- name: Configure ufw defaults
-  ufw: direction={{ item.direction }} policy={{ item.policy }}
-  with_items:
-    - { direction: 'incoming', policy: 'deny' }
-    - { direction: 'outgoing', policy: 'allow' }
-  notify:
-    - restart ufw
+    - name: Disable firewalld if RHEL based
+      shell: "systemctl disable firewalld; systemctl stop firewalld"
+      when: ansible_os_family == "RedHat"
+      
+    - name: Ensure UFW is installed
+      package:
+        name: ufw
+        state: present
 
-- name: Configure ufw rules
-  ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
-  with_items:
-    - { rule: 'limit', port: '22', proto: 'tcp' }
-  notify:
-    - restart ufw
+    - name: Ensure UFW is disabled
+      ufw: state=disabled
+    
+    - name: Reset UFW
+      ufw: state=reset
 
-- name: Enable ufw logging
-  ufw: logging=on
-  notify:
-    - restart ufw
+    - name: Configure ufw defaults
+      ufw: direction={{ item.direction }} policy={{ item.policy }}
+      with_items:
+        - { direction: 'incoming', policy: 'deny' }
+        - { direction: 'outgoing', policy: 'allow' }
+      notify:
+        - restart ufw
 
-- name: Enable ufw
-  ufw: state=enabled
+    - name: Configure ufw rules
+      ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
+      with_items:
+        - { rule: 'limit', port: '22', proto: 'tcp' }
+      notify:
+        - restart ufw
 
-- name: Change root password
-  user:
-    name: root
-    shell: /bin/bash
-    password: "{{ genPass.stdout | password_hash('sha512') }}"
+    - name: Enable ufw logging
+      ufw: logging=on
+      notify:
+        - restart ufw
 
-- name: Change admin password
-  user:
-    name: "{{ ansible_user }}"
-    shell: /bin/bash
-    password: "{{ genPass.stdout | password_hash('sha512') }}"         
+    - name: Enable ufw
+      ufw: state=enabled
+    
+    - name: Change root password
+      user:
+        name: root
+        shell: /bin/bash
+        password: "{{ password | password_hash('sha512') }}"
 
+    - name: Change admin password
+      user:
+        name: "{{ ansible_user }}"
+        shell: /bin/bash
+        password: "{{ password | password_hash('sha512') }}"         
+  become: yes  

roles/web/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Allow Web traffic
+  ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
+  with_items:
+    - { rule: 'allow', port: '80', proto: 'tcp' }
+  notify:
+    - restart ufw
+  become: yes

setup.yml

@@ -1,4 +1,35 @@
 ---
-hosts: all
-roles:
-  - immortal
+
+- hosts: all
+  handlers:
+    - import_tasks: handlers.yml
+  vars_prompt:
+    - name: password
+      prompt: "Enter new root and admin password"
+  roles:
+   - immortal
+  become: yes
+
+- hosts: web
+  handlers:
+    - import_tasks: handlers.yml
+  roles:
+    - web
+  become: yes
+
+- hosts: database
+  handlers:
+    - import_tasks: handlers.yml
+  roles:
+    - database
+  become: yes
+
+- hosts: all
+  vars:
+    pip_install_packages:
+      - name: docker
+
+  roles:
+    - geerlingguy.pip
+    - geerlingguy.docker
+  become: yes