34 lines
899 B
YAML
34 lines
899 B
YAML
---
|
|
# SSH hardening: key-only auth for the admin user via a drop-in config,
|
|
# plus fail2ban to rate-limit brute force attempts.
|
|
|
|
- name: Deploy SSH server hardening drop-in
|
|
ansible.builtin.template:
|
|
src: sshd-hardening.conf.j2
|
|
dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart sshd
|
|
|
|
- name: Validate sshd configuration before restart
|
|
ansible.builtin.command: /usr/sbin/sshd -t
|
|
register: sshd_test
|
|
changed_when: false
|
|
failed_when: sshd_test.rc != 0
|
|
|
|
- name: Deploy fail2ban SSH jail
|
|
ansible.builtin.template:
|
|
src: fail2ban-local.j2
|
|
dest: /etc/fail2ban/jail.local
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart fail2ban
|
|
|
|
- name: Ensure fail2ban is running and enabled
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
enabled: true
|
|
state: started
|
|
when: enable_fail2ban | bool |