AnsiPress/first_run.yml at master · codeablehq/AnsiPress · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
---
# This playbook is for security purposes. It prevents root SSH access and
# sets up the firewall. It creates a non-root user with sudo permissions
# Run it with: $ ansible-playbook first_run.yml -i inventories/production -k
- hosts: all
  user: root
  gather_facts: false

  handlers:
    - name: Restart SSH
      service: name=ssh state=restarted

  tasks:
    - name: Test for root user
      shell: "ssh root@{{ inventory_hostname }} 'echo success'"
      delegate_to: 127.0.0.1
      register: can_login_with_root
      ignore_errors: true

    - name: Create the admin group
      group:
        name: "admin"
        state: "present"
      when: can_login_with_root|success

    - name: Create a webmaster user in the admin group
      user:
        name: "{{ server_user }}"
        comment: "Server User (non-root)"
        password: "{{ server_user_password }}"
        group: "admin"
        shell: "/bin/bash"
      when: can_login_with_root|success

    - name: Copy local ssh key for webmaster user
      authorized_key:
        user: "{{ server_user }}"
        key: "{{ lookup('file', server_user_ssh_key) }}"
      when: can_login_with_root|success

    - name: Prevent password authentication
      lineinfile:
        dest: "/etc/ssh/sshd_config"
        regexp: "^PasswordAuthentication"
        line: "PasswordAuthentication no"
        state: "present"
      notify:
        - Restart SSH
      when: can_login_with_root|success

    - name: Prevent root SSH access
      lineinfile:
        dest: "/etc/ssh/sshd_config"
        regexp: "^PermitRootLogin"
        line: "PermitRootLogin no"
        state: present
      notify:
        - Restart SSH
      when: can_login_with_root|success

    - name: 7.1 Setup ufw (port 22 for SSH)
      ufw: rule=allow port=22 proto=tcp
      when: can_login_with_root|success

    - name: 7.2 Setup ufw (port 443 for HTTPS)
      ufw: rule=allow port=443 proto=tcp
      when: can_login_with_root|success

    - name: 7.3 Setup ufw (port 80 for HTTP)
      ufw: rule=allow port=80 proto=tcp
      when: can_login_with_root|success

    - name: 7.4 Enable ufw
      ufw: state=enabled
      when: can_login_with_root|success