Add 'ansible/ubuntu/setup-pb.yml'

ansible/ubuntu/setup-pb.yml

@@ -0,0 +1,715 @@
+# Initial server setup
+
+#
+
+---
+
+- hosts: all
+
+  become: yes
+
+  vars:
+
+    my_client_ip: 192.168.1.75
+
+    tmzone: America/Vancouver
+
+    sudo_timeout: 60
+
+
+
+    # Set ufw logging: on | off | low | medium | high | full
+
+    ufw_log: off
+
+
+
+    # SSH socket config used for 22.10 and later.
+
+    # Disable any existing listen steam and enable the new stream.
+
+    ssh_socket_cfg: |
+
+      [Socket]
+
+      ListenStream=
+
+      ListenStream={{ ssh_port }}
+
+
+
+    resolved_cfg: |
+
+      [Resolve]
+
+      DNSStubListener=no
+
+      DNS=127.0.0.1
+
+
+
+    f2b_jail_local: |
+
+      [DEFAULT]
+
+      ignoreip = 127.0.0.1/8 ::1 {{ my_client_ip }}
+
+      findtime = 15m
+
+      bantime = 2h
+
+      maxretry = 5
+
+
+
+      [sshd]
+
+      enabled = true
+
+      maxretry = 3
+
+      port = {{ ssh_port }}
+
+
+
+  tasks:
+
+    - name: Get datestamp from the system
+
+      shell: date +"%Y%m%d"
+
+      register: dstamp
+
+
+
+    - name: Set current date stamp variable
+
+      set_fact:
+
+        cur_date: "{{ dstamp.stdout }}"
+
+
+
+    # Update and install the base software
+
+    - name: Update apt package cache
+
+      apt:
+
+        update_cache: yes
+
+        cache_valid_time: 3600
+
+
+
+    - name: Upgrade installed apt packages 
+
+      apt:
+
+        upgrade: dist
+
+      register: upgrade
+
+      retries: 15
+
+      delay: 5
+
+      until: upgrade is success
+
+
+
+    - name: Ensure that a base set of software packages are installed
+
+      apt:
+
+        pkg:
+
+          - apt-transport-https
+
+          - build-essential
+
+          - fail2ban
+
+          - pwgen
+
+          - unbound
+
+          - unzip
+
+          - docker
+
+          - docker-compose
+
+          - net-tools
+
+          - traceroute
+
+        state: latest
+
+
+
+    - name: Create a local systemd-resolved configuration directory.
+
+      file:
+
+        path: /etc/systemd/resolved.conf.d
+
+        state: directory
+
+        owner: root
+
+        group: root
+
+        mode: 0755
+
+
+
+    - name: Create a local systemd-resolved configuration that works with unbound.
+
+      copy:
+
+        dest: /etc/systemd/resolved.conf.d/local.conf
+
+        content: "{{ resolved_cfg }}"
+
+        owner: root
+
+        group: root
+
+        mode: 0644
+
+
+
+    - name: Update the systemd-resolved /etc/resolv.conf symbolic link.
+
+      file:
+
+        src: /run/systemd/resolve/resolv.conf
+
+        dest: /etc/resolv.conf
+
+        state: link
+
+        owner: root
+
+        group: root
+
+
+
+    - name: Restart systemd-resolved
+
+      service:
+
+        name: systemd-resolved
+
+        state: restarted
+
+
+
+    - name: Check if a reboot is needed for Debian-based systems
+
+      stat:
+
+        path: /var/run/reboot-required
+
+      register: reboot_required
+
+
+
+    # Host Setup
+
+    - name: Set static hostname
+
+      hostname:
+
+        name: "{{ inventory_hostname_short }}"
+
+
+
+    - name: Add FQDN to /etc/hosts
+
+      lineinfile:
+
+        dest: /etc/hosts
+
+        regexp: '^127\.0\.1\.1'
+
+        line: '127.0.1.1 {{ inventory_hostname }} {{ inventory_hostname_short }}'
+
+        state: present
+
+
+
+    - name: Check if cloud init is installed.
+
+      stat: path="/etc/cloud/templates/hosts.debian.tmpl"
+
+      register: cloud_installed
+
+
+
+    - name: Add FQDN to /etc/cloud/templates/hosts.debian.tmpl
+
+      lineinfile:
+
+        dest: /etc/cloud/templates/hosts.debian.tmpl
+
+        regexp: '^127\.0\.1\.1'
+
+        line: "127.0.1.1 {{ inventory_hostname }} {{ inventory_hostname_short }}"
+
+        state: present
+
+      when: cloud_installed.stat.exists
+
+
+
+    - name: set timezone
+
+      timezone:
+
+        name: "{{ tmzone }}"
+
+
+
+    # Set sudo password timeout (default is 15 minutes)
+
+    - name: Set sudo password timeout.
+
+      lineinfile:
+
+        path: /etc/sudoers
+
+        state: present
+
+        regexp: '^Defaults\tenv_reset'
+
+        line: 'Defaults env_reset, timestamp_timeout={{ sudo_timeout }}'
+
+        validate: '/usr/sbin/visudo -cf %s'
+
+
+
+    - name: Create/update regular user with sudo privileges
+
+      user:
+
+        name: "{{ user }}"
+
+        password: "{{ user_passwd | password_hash('sha512') }}"
+
+        state: present
+
+        groups: sudo
+
+        append: true
+
+        shell: /bin/bash
+
+
+
+    - name: Ensure ansible_sudo_passwd matches the [new] user password
+
+      set_fact:
+
+        ansible_sudo_passwd: "{{ user_passwd }}"
+
+
+
+    - name: Ensure authorized keys for remote user is installed
+
+      authorized_key:
+
+        user: "{{ user }}"
+
+        state: present
+
+        key: "{{ ssh_pub_key }}"
+
+
+
+    - name: Ensure authorized key for root user is installed
+
+      authorized_key:
+
+        user: root
+
+        state: present
+
+        key: "{{ ssh_pub_key }}"
+
+
+
+    - name: Update root user password.
+
+      user:
+
+        name: root
+
+        password: "{{ root_passwd | password_hash('sha512') }}"
+
+
+
+    - name: Disable password authentication for root
+
+      lineinfile:
+
+        path: /etc/ssh/sshd_config
+
+        state: present
+
+        regexp: '^#?PermitRootLogin'
+
+        line: 'PermitRootLogin prohibit-password'
+
+
+
+    - name: Disable tunneled clear-text passwords
+
+      lineinfile:
+
+        path: /etc/ssh/sshd_config
+
+        state: present
+
+        regexp: '^PasswordAuthentication yes'
+
+        line: 'PasswordAuthentication no'
+
+
+
+    - name: Set user PS1 to a two-line prompt
+
+      lineinfile:
+
+        dest: "/home/{{ user }}/.bashrc"
+
+        insertafter: EOF
+
+        line: "PS1='${debian_chroot:+($debian_chroot)}\\[\\033[01;32m\\]\\u@\\h\\[\\033[00m\\]:\\[\\033[01;34m\\]\\w\\[\\033[00m\\]\\n\\$ '"
+
+        state: present
+
+
+
+    - name: Set root PS1 to a two-line prompt
+
+      lineinfile:
+
+        path: '/root/.bashrc'
+
+        state: present
+
+        insertafter: EOF
+
+        line: PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\n\$ '
+
+
+
+    # Configure the UFW firewall
+
+    - name: Disable and reset ufw firewall to installation defaults.
+
+      ufw:
+
+        state: reset
+
+
+
+    - name: Find backup rules to delete
+
+      find:
+
+        paths: /etc/ufw
+
+        patterns: "*.{{ cur_date }}_*"
+
+        use_regex: no
+
+      register: files_to_delete
+
+
+
+    - name: Delete ufw backup rules
+
+      file:
+
+        path: "{{ item.path }}"
+
+        state: absent
+
+      with_items: "{{ files_to_delete.files }}"
+
+
+
+    - name: Set the ssh '{{ ssh_port }}' port number in sshd_config (ver < 22.10).
+
+      lineinfile:
+
+        dest: /etc/ssh/sshd_config
+
+        regexp: '^#Port '
+
+        line: 'Port {{ ssh_port }}'
+
+        state: present
+
+      when: ansible_facts['distribution_version'] < '22.10'
+
+
+
+    - name: Create a ssh.socket.d configuration directory (ver >= 22.10).
+
+      file:
+
+        path: /etc/systemd/system/ssh.socket.d
+
+        state: directory
+
+        owner: root
+
+        group: root
+
+        mode: 0755
+
+      when: ansible_facts['distribution_version'] >= '22.10'
+
+
+
+    - name: Create a local SSH socket stream configuration (ver >= 22.10).
+
+      copy:
+
+        dest: /etc/systemd/system/ssh.socket.d/listen.conf
+
+        content: "{{ ssh_socket_cfg }}"
+
+        owner: root
+
+        group: root
+
+        mode: 0644
+
+      when: ansible_facts['distribution_version'] >= '22.10'
+
+
+
+    - name: daemon-reload (ver >= 22.10)
+
+      systemd:
+
+        daemon_reload: yes
+
+      when: ansible_facts['distribution_version'] >= '22.10'
+
+
+
+    - name: Restart the ssh service after updating the SSH port number (ver < 22.10).
+
+      service:
+
+        name: ssh
+
+        state: restarted
+
+      when: ansible_facts['distribution_version'] < '22.10'
+
+
+
+    - name: Restart the ssh socket unit after updating the SSH port number (ver >= 22.10).
+
+      systemd:
+
+        name: ssh.socket
+
+        state: restarted
+
+      when: ansible_facts['distribution_version'] >= '22.10'
+
+
+
+    - name: Change the ansible ssh port to '{{ ssh_port }}'
+
+      set_fact:
+
+        ansible_port: '{{ ssh_port }}'
+
+
+
+    - name: Allow ssh port '{{ ssh_port }}'.
+
+      ufw:
+
+        rule: allow
+
+        proto: tcp
+
+        port: '{{ ssh_port }}'
+
+        state: enabled
+
+
+
+    - name: Set the UFW log level.
+
+      ufw:
+
+        logging: '{{ ufw_log }}'
+
+
+
+    - name: configure fail2ban for ssh
+
+      copy:
+
+        dest: /etc/fail2ban/jail.local
+
+        content: "{{ f2b_jail_local }}"
+
+        owner: root
+
+        group: root
+
+        mode: 0644
+
+      notify:
+
+        - restart fail2ban
+
+
+
+    - name: enable fail2ban service on boot
+
+      service:
+
+        name: fail2ban
+
+        enabled: true
+
+        state: started
+
+
+
+    # simple shell script to display fail2ban-client status info; usage:
+
+    #   f2bst
+
+    #   f2bst sshd
+
+    - name: Configure f2bst
+
+      copy:
+
+        dest: /usr/local/bin/f2bst
+
+        content: |
+
+          #!/bin/sh
+
+          fail2ban-client status $*
+
+        owner: root
+
+        group: root
+
+        mode: 0750
+
+
+
+    - name: run needrestart
+
+      command: needrestart -r a
+
+      when: not reboot_required.stat.exists and upgrade.changed
+
+
+
+    - name: Configure static networking
+
+      copy:
+
+        src: etc/netplan/50-cloud-init.yaml
+
+        dest: /etc/netplan/50-cloud-init.yaml
+
+        owner: root
+
+        group: root
+
+        mode: 0644
+
+      notify:
+
+        - netplan apply
+
+      when: cfg_static_network == true
+
+
+
+    - name: Report if reboot is needed.
+
+      debug:
+
+        msg: Rebooting the server, please wait.
+
+      when: reboot_required.stat.exists
+
+
+
+    - name: Reboot the server if needed
+
+      reboot:
+
+        msg: "Reboot initiated by Ansible because of reboot required file."
+
+        connect_timeout: 5
+
+        reboot_timeout: 600
+
+        pre_reboot_delay: 0
+
+        post_reboot_delay: 30
+
+        test_command: whoami
+
+      when: reboot_required.stat.exists
+
+
+
+    - name: Remove old packages from the cache
+
+      apt:
+
+        autoclean: yes
+
+
+
+    - name: Remove dependencies that are no longer needed
+
+      apt:
+
+        autoremove: yes
+
+        purge: yes
+
+
+
+  handlers:
+
+    - name: restart fail2ban
+
+      service:
+
+        name: fail2ban
+
+        state: restarted
+
+      when: reboot_required.stat.exists == false
+
+
+
+    - name: netplan apply
+
+      command: netplan apply
+
+      when: cfg_static_network == true