# Ansible Repository - Linux Server Infrastructure

Automated provisioning and hardening of Linux servers, integrated with an
existing Active Directory environment.

## Supported platforms

- Rocky Linux 9 / RHEL 9 (minimal install)
- Ubuntu 22.04 / 24.04 LTS
- Debian 11 / 12

All roles detect `ansible_facts['os_family']` (`RedHat` / `Debian`) and
`ansible_facts['distribution']` automatically; a single inventory and
playbook run can target a mix of both families. Where the underlying
tooling differs fundamentally (SELinux vs. AppArmor, dnf-automatic vs.
unattended-upgrades), a role runs only on its matching family - see the
role table below.

## Requirements

```bash
ansible-galaxy collection install -r requirements.yml
```

Target hosts must be reachable via SSH from the Ansible control node with
an administrative sudo-capable account.

## Getting started

1. Update `inventories/production/hosts.ini` for your environment
   (hostnames, IP addresses, internal/DMZ group membership).
2. Review and adjust `inventories/production/group_vars/all.yml`
   (domain, AD groups, syslog target, admin subnet, etc.).
3. Set up secrets:
   ```bash
   cp vault/secrets.yml.example vault/secrets.yml
   # fill in values (AD join account, CrowdStrike Falcon CID, ...)
   ansible-vault encrypt vault/secrets.yml
   ```
4. Store the vault password in `.vault_pass` (chmod 600, **do not** commit
   it) or wire it up to your organization's secret store.

## Running

```bash
# Dry run (recommended before every real run)
ansible-playbook playbooks/site.yml --check --diff

# Full rollout
ansible-playbook playbooks/site.yml

# Hardening roles only
ansible-playbook playbooks/site.yml --tags hardening

# Add a new server
ansible-playbook playbooks/baseline.yml --limit <new-hostname>

# Targeted patch run (e.g. for scheduled execution)
ansible-playbook playbooks/patch_only.yml

# Post-deployment sanity checks (read-only)
ansible-playbook playbooks/verify.yml
```

## Quality checks

```bash
ansible-lint
ansible-playbook playbooks/site.yml --syntax-check
```

## Role overview

| Role | Purpose | Platforms |
|---|---|---|
| `base_os` | Base packages, time sync, hostname, disable unneeded services | all |
| `repo_management` | Internal repos always; EPEL/CRB (RedHat) or universe/backports (Debian) only with internet access | all |
| `identity_ad` | sssd/realmd, domain join | all |
| `sudo_rbac` | sudoers.d per AD group | all |
| `local_accounts` | Break-glass account, optional local service accounts | all |
| `banners` | Pre-auth login warning banners (`/etc/issue`, `/etc/issue.net`) | all |
| `ssh_hardening` | sshd_config, public-key-only | all |
| `fail2ban` | SSH brute-force protection (requires EPEL on RedHat family) | all |
| `pam_hardening` | Password complexity (pwquality), account lockout (faillock) | all |
| `cis_hardening` | CIS-style baseline: sysctl, mounts, module blacklist, umask, TMOUT, Ctrl-Alt-Del, sticky bit, journald, auditd, GRUB password | all |
| `selinux_config` | SELinux enforcing mode, booleans, file contexts | RedHat only |
| `apparmor_config` | AppArmor enforce mode, complain-mode exceptions | Debian only |
| `firewall_config` | firewalld default-deny | all |
| `falcon_onboarding` | CrowdStrike Falcon sensor (rpm/deb) | all |
| `logging_rsyslog` | Log forwarding to SIEM, CA certificate distribution | all |
| `aide_integrity` | File integrity monitoring (AIDE) | all |
| `patch_mgmt` | dnf-automatic (RedHat) or unattended-upgrades (Debian) | all |
| `backup_agent` | Veeam agent (optional, per host) | all |

## Open items before rollout

- Finalize the IP scheme in `hosts.ini` (naming scheme: `<site>-<function><number>`, e.g. `GS-AP00015`).
- TLS syslog (6514) vs. plain syslog (514) - depends on the SIEM.
- Set `falcon_onboarding_sensor_package_url` or `falcon_onboarding_sensor_package_src` per host to the package matching that host's OS (rpm for RedHat family, deb for Debian family).
- Set `veeam_agent_repo_url` (RedHat) or `veeam_agent_apt_repo_line` (Debian).
- Set `syslog_ca_cert_enabled`/`syslog_ca_cert_src` once it's clear whether the SIEM certificate is signed by an internal CA (see `roles/logging_rsyslog/files/README.md`).
- Populate `custom_yum_repos`/`custom_apt_repos` with real internal repo URLs; only enable `epel_enabled`/`crb_enabled`/`ubuntu_universe_enabled`/`debian_backports_enabled` where genuinely needed.
- `fail2ban` requires EPEL on RedHat-family hosts - either enable `epel_enabled: true` or provide fail2ban via `custom_yum_repos`.
- Set `cis_grub_password_enabled` and `grub_bootloader_password_hash` (generate with `grub2-mkpasswd-pbkdf2`) if a GRUB bootloader password is desired.
- `admin_space_left_action = halt` in `cis_hardening` (auditd) is a strict setting - confirm this is acceptable, since it halts the system if the audit log volume fills up.
- `cis_boot_hardening_enabled` is off by default since it edits `/etc/fstab` for `/boot` and requires a reboot to take effect - review before enabling.
- The AIDE config-directory include mechanism and default database path/extension (`roles/aide_integrity/vars/Debian.yml`) should be verified against the actual installed `aide`/`aide-common` package version on first rollout - Debian/Ubuntu point releases have varied here.
- Coordinate AIDE database updates (`aide --update`) with the patch-management maintenance window, since scheduled patch runs will otherwise show up as AIDE findings.
- Define CIS Level 2 / AppArmor exceptions per application (see `selinux_config`, `apparmor_config`, and `firewall_config` defaults as a starting point).