You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
roswaal/roles/immortal/tasks/main.yml

149 lines
3.8 KiB

---
# - name: Generate password
# delegate_to: localhost
# shell: bash autopassword.sh {{ inventory_hostname }}
# register: genPass
- name: Backup ssh config
fetch:
src: /etc/ssh/sshd_config
dest: "{{ inventory_hostname }}"
become: yes
- name: Backup os-release
fetch:
src: /etc/os-release
dest: "{{ inventory_hostname }}"
- name: Backup etc/passwd
fetch:
src: /etc/passwd
dest: "{{ inventory_hostname }}"
- name: Collect disk space data
block:
- name: lsblk
shell: lsblk
register: lsblk_output
become: yes
- name: Store results
copy:
content: "{{lsblk_output.stdout}}"
dest: "{{ inventory_hostname }}/lsblk.out"
delegate_to: localhost
become: no
- name: Collect netstat
block:
- name: Run command
shell: netstat -peanut
register: netstat_output
become: yes
- name: Store results
copy:
content: "{{netstat_output.stdout}}"
dest: "{{ inventory_hostname }}/netstat.out"
delegate_to: localhost
become: no
- name: Collect process data
block:
- name: Run command
shell: ps aux
register: ps_output
become: yes
- name: Store results
copy:
content: "{{ps_output.stdout}}"
dest: "{{ inventory_hostname }}/ps.out"
delegate_to: localhost
become: no
- name: Get users
get_users:
#min_uid: "{{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}"
min_uid: 1000
max_uid: 65000
become: yes
register: users_list
- name: Backup all users authorized keys
fetch:
src: "{{item['dir']}}/.ssh/authorized_keys"
dest: "{{ inventory_hostname }}"
ignore_errors: yes
loop: "{{ users_list.users }}"
- name: Give root exclusively the current controller user's SSH key
ansible.posix.authorized_key:
user: root
state: present
key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
exclusive: yes
become: yes
- name: Give all users exclusively the current controller user's SSH key
ansible.posix.authorized_key:
user: "{{item['name']}}"
state: present
key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
exclusive: yes
become: yes
loop: "{{ users_list.users }}"
- block:
- name: Ensure EPEL if RHEL based
yum:
name: epel-release
state: present
when: ansible_os_family == "RedHat"
- name: Disable firewalld if RHEL based
shell: "systemctl disable firewalld; systemctl stop firewalld"
when: ansible_os_family == "RedHat"
- name: Ensure UFW is installed
package:
name: ufw
state: present
- name: Ensure UFW is disabled
ufw: state=disabled
- name: Reset UFW
ufw: state=reset
- name: Configure ufw defaults
ufw: direction={{ item.direction }} policy={{ item.policy }}
with_items:
- { direction: 'incoming', policy: 'deny' }
- { direction: 'outgoing', policy: 'allow' }
notify:
- restart ufw
- name: Configure ufw rules
ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
with_items:
- { rule: 'limit', port: '22', proto: 'tcp' }
notify:
- restart ufw
- name: Enable ufw logging
ufw: logging=on
notify:
- restart ufw
- name: Enable ufw
ufw: state=enabled
- name: Change root password
user:
name: root
shell: /bin/bash
password: "{{ password | password_hash('sha512') }}"
- name: Change admin password
user:
name: "{{ ansible_user }}"
shell: /bin/bash
password: "{{ password | password_hash('sha512') }}"
become: yes