You've already forked ansible-linux-infra
110 lines
5.5 KiB
Markdown
110 lines
5.5 KiB
Markdown
# Ansible Repository - Linux Server Infrastructure
|
|
|
|
Automated provisioning and hardening of Linux servers, integrated with an
|
|
existing Active Directory environment.
|
|
|
|
## Supported platforms
|
|
|
|
- Rocky Linux 9 / RHEL 9 (minimal install)
|
|
- Ubuntu 22.04 / 24.04 LTS
|
|
- Debian 11 / 12
|
|
|
|
All roles detect `ansible_facts['os_family']` (`RedHat` / `Debian`) and
|
|
`ansible_facts['distribution']` automatically; a single inventory and
|
|
playbook run can target a mix of both families. Where the underlying
|
|
tooling differs fundamentally (SELinux vs. AppArmor, dnf-automatic vs.
|
|
unattended-upgrades), a role runs only on its matching family - see the
|
|
role table below.
|
|
|
|
## Requirements
|
|
|
|
```bash
|
|
ansible-galaxy collection install -r requirements.yml
|
|
```
|
|
|
|
Target hosts must be reachable via SSH from the Ansible control node with
|
|
an administrative sudo-capable account.
|
|
|
|
## Getting started
|
|
|
|
1. Update `inventories/production/hosts.ini` for your environment
|
|
(hostnames, IP addresses, internal/DMZ group membership).
|
|
2. Review and adjust `inventories/production/group_vars/all.yml`
|
|
(domain, AD groups, syslog target, admin subnet, etc.).
|
|
3. Set up secrets:
|
|
```bash
|
|
cp vault/secrets.yml.example vault/secrets.yml
|
|
# fill in values (AD join account, CrowdStrike Falcon CID, ...)
|
|
ansible-vault encrypt vault/secrets.yml
|
|
```
|
|
4. Store the vault password in `.vault_pass` (chmod 600, **do not** commit
|
|
it) or wire it up to your organization's secret store.
|
|
|
|
## Running
|
|
|
|
```bash
|
|
# Dry run (recommended before every real run)
|
|
ansible-playbook playbooks/site.yml --check --diff
|
|
|
|
# Full rollout
|
|
ansible-playbook playbooks/site.yml
|
|
|
|
# Hardening roles only
|
|
ansible-playbook playbooks/site.yml --tags hardening
|
|
|
|
# Add a new server
|
|
ansible-playbook playbooks/baseline.yml --limit <new-hostname>
|
|
|
|
# Targeted patch run (e.g. for scheduled execution)
|
|
ansible-playbook playbooks/patch_only.yml
|
|
|
|
# Post-deployment sanity checks (read-only)
|
|
ansible-playbook playbooks/verify.yml
|
|
```
|
|
|
|
## Quality checks
|
|
|
|
```bash
|
|
ansible-lint
|
|
ansible-playbook playbooks/site.yml --syntax-check
|
|
```
|
|
|
|
## Role overview
|
|
|
|
| Role | Purpose | Platforms |
|
|
|---|---|---|
|
|
| `base_os` | Base packages, time sync, hostname, disable unneeded services | all |
|
|
| `repo_management` | Internal repos always; EPEL/CRB (RedHat) or universe/backports (Debian) only with internet access | all |
|
|
| `identity_ad` | sssd/realmd, domain join | all |
|
|
| `sudo_rbac` | sudoers.d per AD group | all |
|
|
| `local_accounts` | Break-glass account, optional local service accounts | all |
|
|
| `banners` | Pre-auth login warning banners (`/etc/issue`, `/etc/issue.net`) | all |
|
|
| `ssh_hardening` | sshd_config, public-key-only | all |
|
|
| `fail2ban` | SSH brute-force protection (requires EPEL on RedHat family) | all |
|
|
| `pam_hardening` | Password complexity (pwquality), account lockout (faillock) | all |
|
|
| `cis_hardening` | CIS-style baseline: sysctl, mounts, module blacklist, umask, TMOUT, Ctrl-Alt-Del, sticky bit, journald, auditd, GRUB password | all |
|
|
| `selinux_config` | SELinux enforcing mode, booleans, file contexts | RedHat only |
|
|
| `apparmor_config` | AppArmor enforce mode, complain-mode exceptions | Debian only |
|
|
| `firewall_config` | firewalld default-deny | all |
|
|
| `falcon_onboarding` | CrowdStrike Falcon sensor (rpm/deb) | all |
|
|
| `logging_rsyslog` | Log forwarding to SIEM, CA certificate distribution | all |
|
|
| `aide_integrity` | File integrity monitoring (AIDE) | all |
|
|
| `patch_mgmt` | dnf-automatic (RedHat) or unattended-upgrades (Debian) | all |
|
|
| `backup_agent` | Veeam agent (optional, per host) | all |
|
|
|
|
## Open items before rollout
|
|
|
|
- Finalize the IP scheme in `hosts.ini` (naming scheme: `<site>-<function><number>`, e.g. `GS-AP00015`).
|
|
- TLS syslog (6514) vs. plain syslog (514) - depends on the SIEM.
|
|
- Set `falcon_onboarding_sensor_package_url` or `falcon_onboarding_sensor_package_src` per host to the package matching that host's OS (rpm for RedHat family, deb for Debian family).
|
|
- Set `veeam_agent_repo_url` (RedHat) or `veeam_agent_apt_repo_line` (Debian).
|
|
- Set `syslog_ca_cert_enabled`/`syslog_ca_cert_src` once it's clear whether the SIEM certificate is signed by an internal CA (see `roles/logging_rsyslog/files/README.md`).
|
|
- Populate `custom_yum_repos`/`custom_apt_repos` with real internal repo URLs; only enable `epel_enabled`/`crb_enabled`/`ubuntu_universe_enabled`/`debian_backports_enabled` where genuinely needed.
|
|
- `fail2ban` requires EPEL on RedHat-family hosts - either enable `epel_enabled: true` or provide fail2ban via `custom_yum_repos`.
|
|
- Set `cis_grub_password_enabled` and `grub_bootloader_password_hash` (generate with `grub2-mkpasswd-pbkdf2`) if a GRUB bootloader password is desired.
|
|
- `admin_space_left_action = halt` in `cis_hardening` (auditd) is a strict setting - confirm this is acceptable, since it halts the system if the audit log volume fills up.
|
|
- `cis_boot_hardening_enabled` is off by default since it edits `/etc/fstab` for `/boot` and requires a reboot to take effect - review before enabling.
|
|
- The AIDE config-directory include mechanism and default database path/extension (`roles/aide_integrity/vars/Debian.yml`) should be verified against the actual installed `aide`/`aide-common` package version on first rollout - Debian/Ubuntu point releases have varied here.
|
|
- Coordinate AIDE database updates (`aide --update`) with the patch-management maintenance window, since scheduled patch runs will otherwise show up as AIDE findings.
|
|
- Define CIS Level 2 / AppArmor exceptions per application (see `selinux_config`, `apparmor_config`, and `firewall_config` defaults as a starting point).
|