initial commit

playbooks/baseline.yml

@@ -0,0 +1,33 @@
+---
+# Onboarding process for a newly added server.
+# Run scoped to exactly the new host:
+#   ansible-playbook playbooks/baseline.yml --limit GS-AP00023 --ask-vault-pass
+#
+# Prerequisite: the host has already been added to
+# inventories/production/hosts.ini (and group_vars/host_vars as needed).
+
+- name: Baseline rollout for a newly added Linux server
+  hosts: "{{ target_host | default('linux_all') }}"
+  become: true
+  vars_files:
+    - ../vault/secrets.yml
+  roles:
+    - role: base_os
+    - role: repo_management
+    - role: identity_ad
+    - role: sudo_rbac
+    - role: local_accounts
+    - role: banners
+    - role: ssh_hardening
+    - role: fail2ban
+    - role: pam_hardening
+    - role: cis_hardening
+    - role: selinux_config
+      when: ansible_facts['os_family'] == "RedHat"
+    - role: apparmor_config
+      when: ansible_facts['os_family'] == "Debian"
+    - role: firewall_config
+    - role: falcon_onboarding
+    - role: logging_rsyslog
+    - role: aide_integrity
+    - role: patch_mgmt

playbooks/patch_only.yml

@@ -0,0 +1,10 @@
+---
+# Targeted patch-management run without re-applying the other roles.
+# Intended for scheduled execution (cron/AWX).
+# Run: ansible-playbook playbooks/patch_only.yml
+
+- name: Apply patch management configuration only
+  hosts: linux_all
+  become: true
+  roles:
+    - role: patch_mgmt

playbooks/site.yml

@@ -0,0 +1,51 @@
+---
+# Full rollout of all roles.
+# Full run:    ansible-playbook playbooks/site.yml --ask-vault-pass
+# Dry run:     ansible-playbook playbooks/site.yml --check --diff
+# Subset only: ansible-playbook playbooks/site.yml --tags hardening
+
+- name: Deploy hardened Linux baseline configuration
+  hosts: linux_all
+  become: true
+  vars_files:
+    - ../vault/secrets.yml
+  roles:
+    - role: base_os
+      tags: [base_os]
+    - role: repo_management
+      tags: [repo_management]
+    - role: identity_ad
+      tags: [identity_ad, hardening]
+    - role: sudo_rbac
+      tags: [sudo_rbac, hardening]
+    - role: local_accounts
+      tags: [local_accounts, hardening]
+    - role: banners
+      tags: [banners, hardening]
+    - role: ssh_hardening
+      tags: [ssh_hardening, hardening]
+    - role: fail2ban
+      tags: [fail2ban, hardening]
+    - role: pam_hardening
+      tags: [pam_hardening, hardening]
+    - role: cis_hardening
+      tags: [cis_hardening, hardening]
+    - role: selinux_config
+      tags: [selinux_config, hardening]
+      when: ansible_facts['os_family'] == "RedHat"
+    - role: apparmor_config
+      tags: [apparmor_config, hardening]
+      when: ansible_facts['os_family'] == "Debian"
+    - role: firewall_config
+      tags: [firewall_config, hardening]
+    - role: falcon_onboarding
+      tags: [falcon_onboarding, hardening]
+    - role: logging_rsyslog
+      tags: [logging_rsyslog, monitoring]
+    - role: aide_integrity
+      tags: [aide_integrity, monitoring]
+    - role: patch_mgmt
+      tags: [patch_mgmt, patching]
+    - role: backup_agent
+      tags: [backup_agent]
+      when: veeam_agent_enabled | default(false) | bool

playbooks/verify.yml

@@ -0,0 +1,78 @@
+---
+# Post-deployment sanity checks. Read-only, makes no changes.
+# Run: ansible-playbook playbooks/verify.yml
+
+- name: Verify baseline hardening status
+  hosts: linux_all
+  become: true
+  gather_facts: true
+  tasks:
+    - name: Collect service facts
+      ansible.builtin.service_facts:
+
+    - name: Check expected services are running
+      ansible.builtin.assert:
+        that:
+          - "'sshd.service' in ansible_facts.services"
+          - "ansible_facts.services['sshd.service'].state == 'running'"
+          - "'firewalld.service' in ansible_facts.services"
+          - "ansible_facts.services['firewalld.service'].state == 'running'"
+          - "'auditd.service' in ansible_facts.services"
+          - "ansible_facts.services['auditd.service'].state == 'running'"
+        fail_msg: "One or more expected core services are not running."
+        success_msg: "Core services (sshd, firewalld, auditd) are running."
+
+    - name: Check SELinux is enforcing (RedHat family)
+      ansible.builtin.command: getenforce
+      register: verify_selinux_status
+      changed_when: false
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Assert SELinux enforcing (RedHat family)
+      ansible.builtin.assert:
+        that:
+          - "verify_selinux_status.stdout == 'Enforcing'"
+        fail_msg: "SELinux is not in enforcing mode."
+        success_msg: "SELinux is enforcing."
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Check AppArmor status (Debian family)
+      ansible.builtin.command: aa-status --enforced
+      register: verify_apparmor_status
+      changed_when: false
+      failed_when: false
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Report AppArmor enforced profile count (Debian family)
+      ansible.builtin.debug:
+        msg: "AppArmor enforced profiles on {{ inventory_hostname }}: {{ verify_apparmor_status.stdout | default('unavailable') }}"
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Check CrowdStrike Falcon sensor health
+      ansible.builtin.command: /opt/CrowdStrike/falconctl -g --rfm-state
+      register: verify_falcon_rfm
+      changed_when: false
+      failed_when: false
+
+    - name: Report Falcon sensor status
+      ansible.builtin.debug:
+        msg: "Falcon sensor RFM state on {{ inventory_hostname }}: {{ verify_falcon_rfm.stdout | default('not installed / not reachable') }}"
+
+    - name: Check AIDE database exists (RedHat family)
+      ansible.builtin.stat:
+        path: /var/lib/aide/aide.db.gz
+      register: verify_aide_db_redhat
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Check AIDE database exists (Debian family)
+      ansible.builtin.stat:
+        path: /var/lib/aide/aide.db
+      register: verify_aide_db_debian
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Assert AIDE database is present
+      ansible.builtin.assert:
+        that:
+          - (verify_aide_db_redhat.stat.exists | default(false)) or (verify_aide_db_debian.stat.exists | default(false))
+        fail_msg: "AIDE database has not been initialized."
+        success_msg: "AIDE database is present."