• Dominik Meyer [email protected]

Some basic Security Hardening plays using Ansible

• create an issue and issue.net from the provided template
• disable root login for ssh
• set maximum number of concurrent alive ssh client sessions
• set maximum number of SSH sessions
• set ssh compression to delayed
• set ssh maximum number of authentication retries
• disable ssh TCP keep alive
• disable X11 forwarding
• enable SSH banner
• default umask in login.defs
• setup minimum password age in login.defs
• setup maximum password age in login.defs
• enable spoof protection
• enable syn cookies
• disable ICMP redirects
• enable kernel address space layout randomization (ASLR)
• install and enable fail2ban
• install and enable rkhunter
• install per user temp dirs
• install debsums for verifying package integrity
• install the debsecan tool
• install lynis
• install usbguard
• disable core dumps
• disable setuid applications core dumps
• disable kernel kernel core dumps
• set pam maxlogins
• set pam nproc
• Disallow opening files in world writeable sticky directories
• Disallow opening fifos in world writeable sticky directories
• Protect hardlinks
• Protect symlinks
• Disallow bpf loading for normal users
• harden bpf jit compilter

Clone this repository into the roles folder of your playbook and add the role

Available variables used in your host repository can be found in defaults/main.yml.

GPLv3