52 lines
1.1 KiB
YAML
52 lines
1.1 KiB
YAML
---
|
|
- name: Secure and Update Fedora 43 Server
|
|
hosts: all
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
ansible_python_interpreter: /usr/bin/python3.14
|
|
tasks:
|
|
# Update system
|
|
- name: Update all packages (safe upgrade)
|
|
ansible.builtin.dnf:
|
|
name: "*"
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: Install security tools
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- audit
|
|
- fail2ban
|
|
- dnf-automatic
|
|
state: present
|
|
|
|
|
|
- name: Configure dnf-automatic for security updates only
|
|
ansible.builtin.template:
|
|
src: automatic.conf.j2
|
|
dest: /etc/dnf/automatic.conf
|
|
|
|
|
|
- name: Ensure dnf-automatic timer is enabled
|
|
ansible.builtin.systemd:
|
|
name: dnf-automatic.timer
|
|
state: started
|
|
enabled: true
|
|
|
|
# Ensure SELinux is enforcing
|
|
- name: Ensure SELinux is in enforcing mode
|
|
ansible.posix.selinux:
|
|
policy: targeted
|
|
state: enforcing
|
|
|
|
# Enable and start fail2ban
|
|
- name: Enable and start fail2ban
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
|