Refactor SSH configuration and update playbook execution in ansible-apply.yaml

.github/workflows/ansible-apply.yaml

@@ -68,7 +68,7 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           for HOST in $TRUSTED_HOSTS; do
-            ssh -vvvv $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
+            ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
           done
 
       - name: Apply Ansible Playbook
@@ -79,6 +79,6 @@ jobs:
         run: |
           cd ansible
           sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml
-          # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml
-          # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml
-          # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml

ansible/playbook_kvm.yml

@@ -19,8 +19,6 @@
       tags:
         - roles
         - roles::cis
-        - roles::cis::ufw
-        - roles::cis::sysctl
     - role: "fail2ban"
       tags:
         - roles
@@ -33,7 +31,6 @@
       tags:
         - roles
         - roles::duosecurity
-
     - role: "virtualization"
       tags:
         - role::virtualization

ansible/playbook_microk8s.yml

@@ -19,8 +19,6 @@
       tags:
         - roles
         - roles::cis
-        - roles::cis::ufw
-        - roles::cis::sysctl
     - role: "fail2ban"
       tags:
         - roles

ansible/roles/cis_hardening/tasks/main.yml

@@ -19,145 +19,209 @@
         PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
   when: ufw_enable
   tags:
-    - ufw
     - roles::cis::ufw
 
 - name: Configure sysctl
   ansible.builtin.include_tasks: sysctl.yml
   tags:
-    - sysctl
     - roles::cis::sysctl
 
 - name: Disable kernel network modules
   ansible.builtin.include_tasks: disablenet.yml
+  tags:
+    - roles::cis::modules
 
 - name: Disable file system kernel modules
   ansible.builtin.include_tasks: disablefs.yml
+  tags:
+    - roles::cis::modules
 
 - name: Disable IPv6
   ansible.builtin.include_tasks: ipv6.yml
   when: disable_ipv6
+  tags:
+    - roles::cis::ipv6
 
 - name: Configure systemd system and users
   ansible.builtin.include_tasks: systemdconf.yml
+  tags:
+    - roles::cis::users
 
 - name: Configure systemd journald and logrotate
   ansible.builtin.include_tasks: journalconf.yml
+  tags:
+    - roles::cis::log
 
 - name: Configure systemd timesyncd
   ansible.builtin.include_tasks: timesyncd.yml
+  tags:
+    - roles::cis::systemd
 
 - name: Clean fstab
   ansible.builtin.include_tasks: fstab.yml
+  tags:
+    - roles::cis::fstab
 
 - name: Configure shm and tmp mounts
   ansible.builtin.include_tasks: mount.yml
+  tags:
+    - roles::cis::mounts
 
 - name: Disable prelink
   ansible.builtin.include_tasks: prelink.yml
+  tags:
+    - roles::cis::prelink
 
 - name: Configure package managers, update caches and install updates
   ansible.builtin.include_tasks: packagemgmt.yml
+  tags:
+    - roles::cis::packages
 
 - name: Configure hosts.allow and hosts.deny
   when: not custom_hosts_acls
   ansible.builtin.include_tasks: hosts.yml
+  tags:
+    - roles::cis::hosts
 
 - name: Configure login.defs
   ansible.builtin.include_tasks: logindefs.yml
+  tags:
+    - roles::cis::logindefs 
 
 - name: Set limits
   ansible.builtin.include_tasks: limits.yml
+  tags:
+    - roles::cis::limits
 
 - name: Configure adduser and useradd
   ansible.builtin.include_tasks: adduser.yml
+  tags:
+    - roles::cis::adduser
 
 - name: Restrict root access
   ansible.builtin.include_tasks: rootaccess.yml
+  tags:
+    - roles::cis::root
 
 - name: Configure needrestart, install and remove various packages
   ansible.builtin.include_tasks: packages.yml
+  tags:
+    - roles::cis::packages
 
 - name: Configure ssh server and client
   ansible.builtin.include_tasks: sshconfig.yml
   tags:
-    - ssh
-    - sshd
     - roles::cis::sshd
+    - roles::cis::ssh
 
 - name: Configure PAM
   ansible.builtin.include_tasks: password.yml
+  tags:
+    - roles::cis::pam
 
 - name: Configure and clean at and cron
   ansible.builtin.include_tasks: cron.yml
+  tags:
+    - roles::cis::cron
 
 - name: Disable systemd ctrl-alt-del.target
   ansible.builtin.include_tasks: ctrlaltdel.yml
+  tags:
+    - roles::cis::ctrlaltdel
 
 - name: Configure auditd
   ansible.builtin.include_tasks: auditd.yml
+  tags:
+    - roles::cis::auditd
 
 - name: Configure AppArmor
   ansible.builtin.include_tasks: apparmor.yml
+  tags:
+    - roles::cis::apparmor
 
 - name: Disable misc kernel modules
   ansible.builtin.include_tasks: disablemod.yml
+  tags:
+    - roles::cis::modules
 
 - name: Disable wireless interfaces
   ansible.builtin.include_tasks: disablewireless.yml
   when: disable_wireless
-
+  tags:
-# https://bugs.launchpad.net/ubuntu/+source/aide/+bug/1903298
+    - roles::cis::wireless
-- name: Configure AIDE
-  ansible.builtin.include_tasks: aide.yml
-  when: >
-    install_aide | bool and
-    (not (ansible_os_family == "Debian" and
-    (ansible_lsb.codename == "groovy" or
-    ansible_lsb.codename == "hirsute")))
 
 - name: Manage users
   ansible.builtin.include_tasks: users.yml
+  tags:
+    - roles::cis::users
 
 - name: Remove suid/sgid permissions
   ansible.builtin.include_tasks: suid.yml
   when: suid_sgid_permissions | bool
+  tags:
+    - roles::cis::suid
 
 - name: Configure compiler permissions
   ansible.builtin.include_tasks: compilers.yml
+  tags:
+    - roles::cis::compilers
 
 - name: Set umask
   ansible.builtin.include_tasks: umask.yml
+  tags:
+    - roles::cis::umask
 
 - name: Configure paths
   ansible.builtin.include_tasks: path.yml
+  tags:
+    - roles::cis::path
 
 - name: Configure systemd logind
   ansible.builtin.include_tasks: logindconf.yml
+  tags:
+    - roles::cis::logind
 
 - name: Configure rkhunter
   ansible.builtin.include_tasks: rkhunter.yml
+  tags:
+    - roles::cis::rkhunter
 
 - name: Add issue message
   ansible.builtin.include_tasks: issue.yml
+  tags:
+    - roles::cis::issue
 
 - name: Configure apport
   ansible.builtin.include_tasks: apport.yml
+  tags:
+    - roles::cis::apport
 
 - name: Lock root account
   ansible.builtin.include_tasks: lockroot.yml
+  tags:
+    - roles::cis::root
 
 - name: Configure Postfix
   ansible.builtin.include_tasks: postfix.yml
+  tags:
+    - roles::cis::postfix
 
 - name: Configure motdnews
   ansible.builtin.include_tasks: motdnews.yml
+  tags:
+    - roles::cis::motdnews
 
 - name: Configure sudo
   ansible.builtin.include_tasks: sudo.yml
+  tags:
+    - roles::cis::sudo
 
 - name: Miscellaneous extra tasks
   ansible.builtin.include_tasks: extras.yml
+  tags:
+    - roles::cis::extras
 
 - name: Miscellaneous tasks after all handlers
   ansible.builtin.include_tasks: post.yml
+  tags:
+    - always

requirements.txt

@@ -1,3 +1,4 @@
 ansible
 ansible-lint
 ansible-playbook-grapher
+passlib