From 414aa1965753f7b36bef540b7a37d8f02c7210ef Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 15:24:11 +0200 Subject: [PATCH 01/34] Update ansible-validate.yaml --- .github/workflows/ansible-validate.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/ansible-validate.yaml b/.github/workflows/ansible-validate.yaml index 6d4eef7..8c7c3e0 100644 --- a/.github/workflows/ansible-validate.yaml +++ b/.github/workflows/ansible-validate.yaml @@ -3,9 +3,7 @@ name: Validate ansible playbooks on: pull_request: branches: - - feature/** - paths: - - "ansible/**" + - feature/* types: - opened - synchronize From 9dfbe14313236f7b86943f7c3109f12eaf55a7a9 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 15:59:09 +0200 Subject: [PATCH 02/34] Update ansible-apply.yaml to change the workflow name from "Validate ansible playbooks" to "Apply ansible playbooks" --- .github/workflows/ansible-apply.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index db6f215..0569356 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -1,4 +1,4 @@ -name: Validate ansible playbooks +name: Apply ansible playbooks on: pull_request: From c91c34fdae7907762139bb55bec86d2d85760c4c Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 16:35:17 +0200 Subject: [PATCH 03/34] Refactor ansible-apply.yaml to improve SSH key handling --- .github/workflows/ansible-apply.yaml | 4 ++-- .github/workflows/ansible-validate.yaml | 2 +- .github/workflows/terraform-validate.yaml | 2 -- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 0569356..d1292d5 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -10,7 +10,7 @@ on: - closed jobs: - plan: + apply-playbooks: runs-on: ubuntu-latest steps: @@ -31,9 +31,9 @@ jobs: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | sectool ssh unlock ansible - cp ssh-keys/ansible ~/.ssh/id_rsa mkdir -p ~/.ssh chmod 700 ~/.ssh + cp ssh-keys/ansible/id_rsa ~/.ssh/id_rsa chmod 600 ~/.ssh/id_rsa - name: Apply Ansible Playbook diff --git a/.github/workflows/ansible-validate.yaml b/.github/workflows/ansible-validate.yaml index 8c7c3e0..1fb02ad 100644 --- a/.github/workflows/ansible-validate.yaml +++ b/.github/workflows/ansible-validate.yaml @@ -10,7 +10,7 @@ on: - reopened jobs: - plan: + validate-playbooks: runs-on: ubuntu-latest steps: diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml index 2a05c8e..86c27b6 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-validate.yaml @@ -22,8 +22,6 @@ jobs: - name: Setup Sectool uses: a13labs/setup-sectool@v1 - with: - version: 0.0.3 - name: Terraform Init env: From 26e1519c541385e84e17f90ef0d19fea6bbdd5f7 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 16:37:19 +0200 Subject: [PATCH 04/34] Refactor ansible-apply.yaml to simplify workflow triggering --- .github/workflows/ansible-apply.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index d1292d5..f9bcad1 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -1,13 +1,11 @@ name: Apply ansible playbooks on: - pull_request: + push: branches: - main paths: - "ansible/**" - types: - - closed jobs: apply-playbooks: From 075447cd945fec046d25092c77fea2d2ec6edb87 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 16:39:03 +0200 Subject: [PATCH 05/34] Refactor ansible-validate.yaml and add main branch trigger --- .github/workflows/ansible-validate.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ansible-validate.yaml b/.github/workflows/ansible-validate.yaml index 1fb02ad..ecdf42b 100644 --- a/.github/workflows/ansible-validate.yaml +++ b/.github/workflows/ansible-validate.yaml @@ -3,7 +3,7 @@ name: Validate ansible playbooks on: pull_request: branches: - - feature/* + - main types: - opened - synchronize From 49e15f441cb88aee4528c1295189d57f917b338c Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 16:43:43 +0200 Subject: [PATCH 06/34] Refactor file paths in Terraform workflows --- ...apply.yaml => terraform-k8apps-apply.yaml} | 6 +- ...te.yaml => terraform-k8apps-validate.yaml} | 15 +- resources/iac_user,yaml | 141 ++++++++++++++++++ 3 files changed, 153 insertions(+), 9 deletions(-) rename .github/workflows/{terraform-apply.yaml => terraform-k8apps-apply.yaml} (89%) rename .github/workflows/{terraform-validate.yaml => terraform-k8apps-validate.yaml} (79%) create mode 100644 resources/iac_user,yaml diff --git a/.github/workflows/terraform-apply.yaml b/.github/workflows/terraform-k8apps-apply.yaml similarity index 89% rename from .github/workflows/terraform-apply.yaml rename to .github/workflows/terraform-k8apps-apply.yaml index 921ca37..909ede8 100644 --- a/.github/workflows/terraform-apply.yaml +++ b/.github/workflows/terraform-k8apps-apply.yaml @@ -5,7 +5,7 @@ on: branches: - main paths: - - "k8sapps/**" + - "terraform/k8sapps/**" jobs: apply: @@ -29,12 +29,12 @@ jobs: env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform init - name: Terraform Apply env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-k8apps-validate.yaml similarity index 79% rename from .github/workflows/terraform-validate.yaml rename to .github/workflows/terraform-k8apps-validate.yaml index 86c27b6..7cb214f 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-k8apps-validate.yaml @@ -1,12 +1,15 @@ name: Validate Terraform on: - push: + pull_request: branches: - - feature/** + - main paths: - - "k8sapps/**" - + - "terraform/k8sapps/**" + types: + - opened + - synchronize + - reopened jobs: plan: runs-on: ubuntu-latest @@ -27,12 +30,12 @@ jobs: env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform init - name: Terraform Plan env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform plan diff --git a/resources/iac_user,yaml b/resources/iac_user,yaml new file mode 100644 index 0000000..a0486d2 --- /dev/null +++ b/resources/iac_user,yaml @@ -0,0 +1,141 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: collabora + name: admin-collabora +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: gitea + name: admin-gitea +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: m3uproxy + name: admin-m3uproxy +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: nextcloud + name: admin-nextcloud +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: wordpress + name: admin-wordpress +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: namespace-creator +rules: + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["create", "get", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-collabora-binding + namespace: collabora +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-collabora + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-gitea-binding + namespace: gitea +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-gitea + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-m3uproxy-binding + namespace: m3uproxy +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-m3uproxy + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-nextcloud-binding + namespace: nextcloud +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-nextcloud + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-wordpress-binding + namespace: wordpress +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-wordpress + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: namespace-creator-binding +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: ClusterRole + name: namespace-creator + apiGroup: rbac.authorization.k8s.io From b14cfdbc3f7c4805e81750e13dd80b683979faec Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 16:56:41 +0200 Subject: [PATCH 07/34] Refactor ansible-apply.yaml to configure SSH and disable host key checking --- .github/workflows/ansible-apply.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index f9bcad1..50e5e85 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -34,11 +34,17 @@ jobs: cp ssh-keys/ansible/id_rsa ~/.ssh/id_rsa chmod 600 ~/.ssh/id_rsa + - name: Configure SSH to Disable Host Key Checking + run: | + mkdir -p ~/.ssh + touch ~/.ssh/config + echo -e "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile=/dev/null\n" >> ~/.ssh/config + chmod 600 ~/.ssh/config + - name: Apply Ansible Playbook env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} - ANSIBLE_HOST_KEY_CHECKING: False run: | cd ansible sectool exec ansible-playbook -i inventory/hosts playbook_microk8s.yml From c01cc05b28f056cc928a9068113fcbaf3a4ea0ae Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 16:58:29 +0200 Subject: [PATCH 08/34] Add host_vars for jammy.simple_server.yml --- ansible/host_vars/jammy.simple_server.yml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ansible/host_vars/jammy.simple_server.yml diff --git a/ansible/host_vars/jammy.simple_server.yml b/ansible/host_vars/jammy.simple_server.yml new file mode 100644 index 0000000..e9fb33b --- /dev/null +++ b/ansible/host_vars/jammy.simple_server.yml @@ -0,0 +1,3 @@ +# Hostname and other host settings +hostname: jammy.local + From 8c4017ba45def2beed8c882c2aef7eaa7da0d212 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:02:55 +0200 Subject: [PATCH 09/34] Refactor SSH configuration in ansible-apply.yaml and add trusted hosts --- .github/workflows/ansible-apply.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 50e5e85..271ccc1 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -35,11 +35,13 @@ jobs: chmod 600 ~/.ssh/id_rsa - name: Configure SSH to Disable Host Key Checking + env: + TRUSTE_HOSTS: ${{ secrets.TRUSTED_HOSTS }} run: | mkdir -p ~/.ssh - touch ~/.ssh/config - echo -e "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile=/dev/null\n" >> ~/.ssh/config - chmod 600 ~/.ssh/config + for host in $TRUSTED_HOSTS; do + ssh-keyscan -H $host >> ~/.ssh/known_hosts + done - name: Apply Ansible Playbook env: From 8ea0c7c5601f6f587c20edda88d97b71c669dc19 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:03:55 +0200 Subject: [PATCH 10/34] Add host_vars for jammy.virtualization_server.yml --- ansible/host_vars/jammy.virtualization_server.yml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ansible/host_vars/jammy.virtualization_server.yml diff --git a/ansible/host_vars/jammy.virtualization_server.yml b/ansible/host_vars/jammy.virtualization_server.yml new file mode 100644 index 0000000..e9fb33b --- /dev/null +++ b/ansible/host_vars/jammy.virtualization_server.yml @@ -0,0 +1,3 @@ +# Hostname and other host settings +hostname: jammy.local + From 70f26d0170e64ae7fe49d157b84b03480fa7d88d Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:09:20 +0200 Subject: [PATCH 11/34] Refactor hostname in contabo01.a13labs.pt.yaml --- ansible/host_vars/contabo01.a13labs.pt.yaml | 2 +- ansible/inventory/hosts | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ansible/host_vars/contabo01.a13labs.pt.yaml b/ansible/host_vars/contabo01.a13labs.pt.yaml index 16ba971..30fc5cf 100644 --- a/ansible/host_vars/contabo01.a13labs.pt.yaml +++ b/ansible/host_vars/contabo01.a13labs.pt.yaml @@ -1,5 +1,5 @@ # Hostname and other host settings -hostname: contabo01.alexpires.me +hostname: contabo01.a13labs.pt # SSH Connection and security sshd_port: 22 diff --git a/ansible/inventory/hosts b/ansible/inventory/hosts index 271716f..8655787 100644 --- a/ansible/inventory/hosts +++ b/ansible/inventory/hosts @@ -24,3 +24,6 @@ contabo01.a13labs.pt [nextcloud] contabo01.a13labs.pt + +[microk8s] +contabo01.a13labs.pt From 7c4093c5b983b21138df0dab5759a8d74042c4eb Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:16:31 +0200 Subject: [PATCH 12/34] Refactor SSH configuration in ansible-apply.yaml and fix trusted hosts --- .github/workflows/ansible-apply.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 271ccc1..c17e964 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -6,6 +6,7 @@ on: - main paths: - "ansible/**" + - .github/workflows/ansible-apply.yaml jobs: apply-playbooks: @@ -40,7 +41,7 @@ jobs: run: | mkdir -p ~/.ssh for host in $TRUSTED_HOSTS; do - ssh-keyscan -H $host >> ~/.ssh/known_hosts + ssh-keyscan $host >> ~/.ssh/known_hosts done - name: Apply Ansible Playbook From 5c0b820a35d72ec79ad555c5d7d3851476a9a3e9 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:17:55 +0200 Subject: [PATCH 13/34] Refactor SSH configuration in ansible-apply.yaml and fix trusted hosts --- .github/workflows/ansible-apply.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index c17e964..d2dd6b2 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -43,6 +43,7 @@ jobs: for host in $TRUSTED_HOSTS; do ssh-keyscan $host >> ~/.ssh/known_hosts done + chmod 600 ~/.ssh/known_hosts - name: Apply Ansible Playbook env: From f92c30b4eb96667bcb321aafc6605e44a034fe85 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:19:27 +0200 Subject: [PATCH 14/34] Refactor requirements.txt and requirements-dev.txt --- requirements-dev.txt | 8 ++++++++ requirements.txt | 5 ----- 2 files changed, 8 insertions(+), 5 deletions(-) create mode 100644 requirements-dev.txt diff --git a/requirements-dev.txt b/requirements-dev.txt new file mode 100644 index 0000000..fc3a0e2 --- /dev/null +++ b/requirements-dev.txt @@ -0,0 +1,8 @@ +ansible +ansible-lint +molecule +molecule-podman +molecule-vagrant +ansible-playbook-grapher +passlib +pytest-molecule diff --git a/requirements.txt b/requirements.txt index fc3a0e2..e387765 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,8 +1,3 @@ ansible ansible-lint -molecule -molecule-podman -molecule-vagrant ansible-playbook-grapher -passlib -pytest-molecule From 63efc31e35dda36eb4aef12300f5d5155078fb3c Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:20:09 +0200 Subject: [PATCH 15/34] Refactor SSH configuration in ansible-apply.yaml and fix trusted hosts --- .github/workflows/ansible-apply.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index d2dd6b2..37afab2 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -40,9 +40,11 @@ jobs: TRUSTE_HOSTS: ${{ secrets.TRUSTED_HOSTS }} run: | mkdir -p ~/.ssh + touch ~/.ssh/known_hosts for host in $TRUSTED_HOSTS; do ssh-keyscan $host >> ~/.ssh/known_hosts done + cat ~/.ssh/known_hosts chmod 600 ~/.ssh/known_hosts - name: Apply Ansible Playbook From 85d97a8d743b0c2b4c9d31642c11a5a02e495f72 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:22:31 +0200 Subject: [PATCH 16/34] Refactor SSH configuration in ansible-apply.yaml and fix trusted hosts --- .github/workflows/ansible-apply.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 37afab2..1cc5aab 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -37,14 +37,12 @@ jobs: - name: Configure SSH to Disable Host Key Checking env: - TRUSTE_HOSTS: ${{ secrets.TRUSTED_HOSTS }} + TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} run: | mkdir -p ~/.ssh - touch ~/.ssh/known_hosts for host in $TRUSTED_HOSTS; do ssh-keyscan $host >> ~/.ssh/known_hosts done - cat ~/.ssh/known_hosts chmod 600 ~/.ssh/known_hosts - name: Apply Ansible Playbook From 2e105db48c0869c89b7801d103adcae544c84e49 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:25:15 +0200 Subject: [PATCH 17/34] Refactor SSH configuration in ansible-apply.yaml and add private key for playbook execution --- .github/workflows/ansible-apply.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 1cc5aab..eb87628 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -51,7 +51,7 @@ jobs: ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} run: | cd ansible - sectool exec ansible-playbook -i inventory/hosts playbook_microk8s.yml - sectool exec ansible-playbook -i inventory/hosts playbook_gitea.yml - sectool exec ansible-playbook -i inventory/hosts playbook_nextcloud.yml - sectool exec ansible-playbook -i inventory/hosts playbook_wordpress.yml + sectool exec ansible-playbook -i inventory/hosts playbook_microk8s.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -i inventory/hosts playbook_gitea.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -i inventory/hosts playbook_nextcloud.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -i inventory/hosts playbook_wordpress.yml --private-key ~/.ssh/id_rsa From ca808929755635c3805f0655c2cbc0aaeaf4ab92 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:30:20 +0200 Subject: [PATCH 18/34] Refactor SSH configuration in ansible-apply.yaml and update playbook execution with specified user --- .github/workflows/ansible-apply.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index eb87628..f160319 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -51,7 +51,7 @@ jobs: ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} run: | cd ansible - sectool exec ansible-playbook -i inventory/hosts playbook_microk8s.yml --private-key ~/.ssh/id_rsa - sectool exec ansible-playbook -i inventory/hosts playbook_gitea.yml --private-key ~/.ssh/id_rsa - sectool exec ansible-playbook -i inventory/hosts playbook_nextcloud.yml --private-key ~/.ssh/id_rsa - sectool exec ansible-playbook -i inventory/hosts playbook_wordpress.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml --private-key ~/.ssh/id_rsa From d184a0cbd36e36099df27318814fc5235a5d3bab Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:44:06 +0200 Subject: [PATCH 19/34] Refactor SSH configuration in ansible-apply.yaml and update playbook execution with ECDSA private key --- .github/workflows/ansible-apply.yaml | 12 ++++++------ ssh-keys/ansible/id_ecdsa.key | 1 + ssh-keys/ansible/id_ecdsa.pub | 1 + 3 files changed, 8 insertions(+), 6 deletions(-) create mode 100644 ssh-keys/ansible/id_ecdsa.key create mode 100644 ssh-keys/ansible/id_ecdsa.pub diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index f160319..0fb008a 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -32,8 +32,8 @@ jobs: sectool ssh unlock ansible mkdir -p ~/.ssh chmod 700 ~/.ssh - cp ssh-keys/ansible/id_rsa ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa + cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa + chmod 600 ~/.ssh/id_ecdsa - name: Configure SSH to Disable Host Key Checking env: @@ -51,7 +51,7 @@ jobs: ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml --private-key ~/.ssh/id_rsa - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml --private-key ~/.ssh/id_rsa - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml --private-key ~/.ssh/id_rsa - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml --private-key ~/.ssh/id_rsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml --private-key ~/.ssh/id_ecdsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml --private-key ~/.ssh/id_ecdsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml --private-key ~/.ssh/id_ecdsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml --private-key ~/.ssh/id_ecdsa diff --git a/ssh-keys/ansible/id_ecdsa.key b/ssh-keys/ansible/id_ecdsa.key new file mode 100644 index 0000000..de07b68 --- /dev/null +++ b/ssh-keys/ansible/id_ecdsa.key @@ -0,0 +1 @@ +rqj9+32dGlvREkyWG/e8k6MaEjCZn91thFZXnEydovKfdG8J1xnuI0fZiYbPG636r2yPySXkVWglZdKd0x9KLqT06jVDIJI0cPJ0tIi0yHYy04cAtcKFT0L46tXJemjbUX1wrBKyAtzlqBGtEHHFjASFLnhw+rEpP+5jrYMpHh/H0z/ac5eHohXauj9KxGeLLIe2hDDn19mNghnDm0rP+zBWnwx81JYQFMtOL02M+DF3zp5lU1TZ4srzhNUoFHjCzrj/yuksBdWWqP8TcNyzwaFmJW7q/PtX6h/cuwPt8vnLhNo5t5iPr9VL9sTfIjkvdYMErtwHY3m8CHF7naa83NAtPXhAV+74rUjiW0WPGAZDfASql9yVJofwFmn3s0pP1vRwHeJ4NAtHiG9ScR1eI7+B3Sf5bkFM7n4hP23l01NTaKV8UKTHyDuctH+/MeUYAImimSxJNAANr0xyOeluJREn0y3P0DvY8CpPQNcF9LDtUCLM3/2/W2z7p+mkPKtmZscgoEhaEY4Y/N7807cmxcIBLbL5etRpofJ/3EA6zZfrVYK0+amuRMTEtJGLhs5I8t9hHjNprSZU1rtb4ZC4fcvBwtJ5sdP9I89BMhAqzB6PcPLnXm2lTA== \ No newline at end of file diff --git a/ssh-keys/ansible/id_ecdsa.pub b/ssh-keys/ansible/id_ecdsa.pub new file mode 100644 index 0000000..d113bdd --- /dev/null +++ b/ssh-keys/ansible/id_ecdsa.pub @@ -0,0 +1 @@ +ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFBAP7dYOsOGKH1UeyEzWtOv+e46AuJgcN4QiMQdOB9tft2JzR2epd1/e9VDsqN8cGcbIYi6TvsgA+IVtK4bj6wDACt/FHol1L3vV2xK3/dtbu5SEPkkksL8mqB4LXdsepHuapqhVgEanSSysbpRYytcfsy2Rtwi/Wa+8c8+302lTfG3w== From ef8f322bc36136c55f861476c4cfcdca89457159 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:44:16 +0200 Subject: [PATCH 20/34] Refactor SSH keys for ansible playbook execution --- ssh-keys/ansible/id_rsa.key | 1 - ssh-keys/ansible/id_rsa.pub | 1 - 2 files changed, 2 deletions(-) delete mode 100644 ssh-keys/ansible/id_rsa.key delete mode 100644 ssh-keys/ansible/id_rsa.pub diff --git a/ssh-keys/ansible/id_rsa.key b/ssh-keys/ansible/id_rsa.key deleted file mode 100644 index 283d019..0000000 --- a/ssh-keys/ansible/id_rsa.key +++ /dev/null @@ -1 +0,0 @@ -+Sc6FDhSEm+ANyq0s2rxgkFLiF1kWuRdt8HjlZR6b5rYh6EcYXXkKBrRapCTqzpXNROOcXxyGU9sZBSB9O0PJMWPQEitx722sSSt9W5poFRhIUGXnK00BN0K4M/Ng0RFKXaGcOef0iDL99jsAVh3ladg642Ccy7rDZebmojdsCfFo6W8QuM4FHiTJdp1IFNSVNmd58fL9NHDPg8sBblt5Q1hagHXSliz26xa6j1eK0T5YsiAsV7J19zpTRTsnXi/vZuTdtGIuQZUv3DC2PGxhu/iiA2G9AY/HC1bDuqUL+UOX8SUEtO7kWDFlqMODoJcVYjxSE3pmG0sdrsXk6GE7xFMvhYAA3/KIDTm5YLqmxrA5A7uDzCo6fDHBBjKQO9JapOCaF7y+rmLDaCt1zZj4D7ne3RjVtxCWyUmb/3vnJfcW3ZZ44PlGPoBME6UTB0RQCXgJp3tLD8A92v7VPkNImP6+/AwhLZjlMFKSjU9YilWMOQKcgctkPX6dEpyUPi/PvVDzS96r0GfHIbfqq+670KWatWzw6ihmyt0Uf/eNd2FNaAOQ6gKmdIsqjnHjQEWhFNy0W2OMQsMfYARK57jx0yTQRtJ6bMYJW4Ua8/ZqM3miXO+0ZyMSgDAKHdfqh00xykY832Ju0fnOt6INCdugUfMpZeHLvLdja1rSmFurOq1geJD9vZtRiga5jl793rCE6mrqGEZ0+j9FKGTwuXsQEvPIXmp1CMEovFQ/Q7lQH0NDjEXI9VIwx7chqIDPFQXdG5LHLZ+3kMlOZrIs4XUAfJgxIHmY+BUi2kDbFwY3nNoumUvulWB3Fx+6cU/F3gX4aSbxe7wGPiySd0any6k0JeUyZLfd+wT2I3Xg7QUY8zoWVIqrkW4eT/Elgou7ud3OCzJ0lvQ/IHC+CkTIMYwpc8P6agzqXUG05C+cbjQ14TGaidkOXHrqn2QWb701C1aslJLlcbX7p0rWlt7anM0ncqBS8iZvCKPvANzqPyx12rLh4tU/KzfOx33vS22Ez5eK/qsTwmzROnRCn/4RxQpCIxEBLHyEIzA4RnxG4Y3ILC0H47KCjCRiXPgmCUI/zId5IjzU1rqUCUddPSroSE4NjwNBKcsm7vM1D50rRPQJK9aCPRq3fvIuaUOpDxphCH2FbQHEr5QTx6h3ZdtdquaHEcgD+2RCc2XJ1whYhheSzCb+BV+AkPc0XKjDVJPLQr/fuHzbsZbqL62ftjgdsSWriYSAouJlW1GYdm4m4FmmZY7J9FoCCCxkZe0Yt4nCWNEYjYItHrSUZk3SIb/ogzO5UMC5HRki/wW15pD1Zeht7Tuo0Kd7GKtL84uvYk+YKUyIZCcqrRWoS3Edzbs4aJfHVnF/QEnDng/r1v49OmvEa16SXe/HOG/PUp/BVdXrFgbsRdMTp1UBwCuASy5IN60hDzG05+kkvoz7rQEj4ucUFqT6lziD2cO8e/WnN4yBaT+hDMEd1swJFTfqa0PXwvaA49EI89s0LNkdQqeQPd8+8RUfageWTJbSYbjOBSJMB+NBBeeLTcWzib8MDVXyCQ7Gbe3rH06FoY/SaART61GkfNqWN/ez+32FQve0bws5jr13+498rdxwu7MZCgjRUyFJZBPg8LM9mt4pj54XbyPdsEcNdrMezofNSj537ub0Yb09zAO0amBCBr9OxLD1VELX0k9JX8FvashiNUMiD8FtDKcYS1opKilQDfJfLv7hnqdwSDeljt0v/FgUoLeRqPoV4k0L7yZQUjAnpB3/GHJBT0Z94SaQxscEeqjxdbI4mAse+3Y1SUBQSD88jtBCQyouDbBlDMTlqXs5t1DrWXuOUEfSrvsx8ToY6CAPxNF5DK0+ZLbSOLp6N1yAQCToceZDbhwgRqlw8JZFEXKIr8IZhuJWoXArAg3QVp9TRH3M4SzeeRajAqIHGOOzmP1IweZ1Zmulen0naUKPQaGIr6GD1zEEGBTzvAMwZTVbgnUzbcBXGraKk9wbbp8Gd2l2GHhAeSJd4A6EnNLacO+6FY2GV+UgBlP7K/EVgU4mXSG6pktPqwUlNRfgPqQ8hzRElKknsEQ/hZRlRmjkLxcTuPV/GYzPMjnEdp6EdCERLxsvwYynH4RAxAclWkGIjRNljwRpsI1Xrgk752kmev0Kpc7oMG2yrIrnfKRrd3F/MueRA2ithzM62lFw9V5qjrDe85J7MsoVJA9RlyF15FNul4nDUEe3EHN6apL2i8XoOl0j1B7rku9fr0ygWiYCQgcI4WFuQyU5fom4CT1d+KMeMncicfUlVsc9kixMiRsluErMlhj09XY//Dl9npKEdUvIZqBNMr96HuQCCreUbQCvx2CUvsUQO+r988EzwiHtideJOlZwzf5cXjC9ROjvnO8A9nc2BhCnrJwkcaupkS40b3EgbmUMbxbWttTFusE4tdMMWt/f7JXORBze5dtqV17ilWL0iEfoYUPis6dvgHhAD54pi8EoQ7ysiUwR0aEU3oKT1DV59B//zn4vHjCMtfNzQCQV5/58heVPZOo5ft8IIegubj/8tux02OqnamxKOLTOGlpTK2yH2vP2v48B6Huysuk6zmOf2BCBfT6CJL1v1ehu4QbK60f7TvVle4pNXma4/c7IFAUfLiwCAycKzQQ5ueuaRFOMmWZ1tVQWFh4uZjAybiMl0TR9OAj9A+LGOijcY7UfUDB6ryOXBjLzQW/pV+jlpqUr66IWWRRMA7KJ3CS5tPFM3kq/LwFSJqv96JG3bSvHCt3wittUivrd1QbvoWKjEs4+o2oAQ4vXQDMJmQfbzXHwkzKKxahxnbJeVrtzS2RWk/0HihH+ZGjNDcp7g8kFpboKmwcg6e/pDc5Ibl+Ip4FLbRd4BxiCvIuvAFU13bjR58lqYQBegtemn2Lq3ppK4OTGx0q770eFuR0MzHi3tAWXHX4l24HkTlQZabEOeTTuKuOhTMN7YFmc9MzdttX6Idk9hM5eI75p5vfjt+dN8b2+QeR0hGSgjk/f1DO7j5YFY8kAZCdI0s/Uy88WJXr8M7XtojxBF4f7ie6lgq/FbZBOTReQ8LU0WuKe5LvMnPvscmX5iLadEaeWXAGCONjGVDzkgbEar3LAc79fpvBtKIsrNKTzIfYwKiFoCC2vZNF/FXx5siaeP0B0Ah8PHqbsX5PmadbAY7iaB75tSiQ+rsKLGpt/Dc+Em0pop95dUCB1bNAIQeBBzvNm1b8Qg5V4ynBNtar/fWTHLUgXL5eNX68Swu4l2s0ZDivVaFYP1V7sd0ovAgb7yvbZdIzlw1IsU+iBcxj5HSAJpnzA0G4SCLtismcKq58Qw6AXV+ZUFGsa/bER65JlpHXwokiJSP7zSFIMZDOCZulJXzxxkrUnio3Fi2gHjZFRr9ihxIv4sxif0oEvKQtkNDQPF3zdYJ+8AIz3GNRt6vGC7WzqswItF75+VlEjUM//TtAH/aUn7Uo4uyktPOZpc/7aQkUMpptYu6kY704tkIRuwnVBE/tU7860N79CUN3G2mRuprIlYpXXnGWAXn+7Rus+kslztVJ5Aqw+HQAAk34zOT+B7A432YwhwDA6bppZOzZi92HiaXTlHzaCM6E69UXatcc8//aU/8YVAjnVXH6cWOt+5gABGB8LL6e8N7TZhYmiFYyIAZQrMNvtZWJBZYvgr2zXfWQSYS8qsOoudh3sCvU9IcRC8p1+NGsFTGiCCohrubn+9IBkKwVr1EEkwMpm1ed1z9+3ND6V89h73Vd7F2RQp+dxSX8+tEYIMLXzYOR2Eh0RjUqUn1YSwBhS7lFUu6mNFN1K1ml/fMG5CtGYAOce61RXqyDfUPRRraG64JksKiuga3sM11WYqEDFOtllWerhlkp7FrnJoIpZys7fQFItCcOwVaCQBzNjHUNYhWaUEm2V49i4qhcsiXEzn/2Bhn9UoxJNknclUn4QkzihSD2l7E1aukeQJQpxIG5ViLbsdQUY1IVIjaJ+M0y8v2bAOFmZ7JyEWDaMj5Qatd5AW4NfKYf0xct4alXJ1AZPqhF5swx+Y8lPqniYeeO93My0Oyv7mVnY89raDfJ9mM9+gH6SaB/gO/22/Gic4kPuPCbshZAaW5uDemhncK8aJVOcINw2IM5iTCd7QxbY/ane8bkmPh3gYggsNYIGc2I+gveLX9YlnVNVy8OxWyMNBOzAM2pSQ1xImfam96yIrG/2SKTRnGJ7+h8bqZmNbMS8coFT5uEbSYcMffrfPK20UprdtZH1r1W75j5muaKZPBXjo8Dz5FJMii4fs+4wsMquf5H7NPq8AO9/0d4V7TPte+z5xLiOAJSQe+rt4sijQ7/QKx7dZVumKOgSzaLtcPLZTtwXT15p7l9f72c3LsP/0tMdO/gKgs9tlXaryoT+cww2wKPnId7duaOri0rpKpCkUlgThBoeDcbOafMrZElcoExGBQFkKvZ0eArj73lxxFbrt0wkR33TfmUDZoMBMwbrIZap6P1nmkgXKqE3+TuqKTxQmTBRAMor2S2F3t89Pa9BJfoFG0B494ZM3gZVUNcaOn309gSfJrYFcLaoQnBwfcwFIibv8+oELTjC+h8 \ No newline at end of file diff --git a/ssh-keys/ansible/id_rsa.pub b/ssh-keys/ansible/id_rsa.pub deleted file mode 100644 index 13fb42a..0000000 --- a/ssh-keys/ansible/id_rsa.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6+Pa5P2WrLsI/BVsM5MxvUWjvGOAcevBuu3XMvVG5dzjepyQlkIg+XV6O4+1ej8SZYXFXNhdEe49hKkw0j/2cH28/1caAMl8BUlIYMBoTKzEfEyXBHw+1QLdvWBlLH8uPoXnVrvPkAx8twVWXF9CPVD6EsBh6tmYen0GwR8rQAOLj0ZEWSzeKZP5XU7ls1IYTtt0ila1Njb3q4bt4AjMdPpstFKknta4vkXr1C/Mn6lnqHRqY9lVyItmzF6EBaCO1JoKbjpOpQ3eKMS9fZrpapr9oCCSV9tcVd3vWxOSJsBeru9WIHFltEEF5lgp2OWqO8E0SS9jYGGvFqfYGyNrBBXwElzI0NiWFlaq+rYR9/5KS6YEnfLYsR+pl1L79QDqGdptGzfEfWkPvge+dRVFtBUwcmcss7F3KoznCm0unULjtjqiDZBv6NG2B/i9l3W5Q9Sfy4BaCYxaLKL5RePFFFSsEosUcrCwT38I52rjNpkZcU8wUK3rdncS+OKJLlOzuM28yXSH4FhFTP8L+7io9EVfESpjUqbtFb55ahyr79hAkT/0NLrcv/dIMmXx3K56Z4hG6QtavmhinPOLsYdGWiK9wLYhq0jBqaKqwQ+lBKwuViV6gVcxCcqlnYxTZuQsXbNSnwp/VABa0J5QoqpF+VSRAj6MzbdWfNkL/RZ6KjQ== From caf983b39cd1d9b416ac58f0f07990612e8e3d90 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 17:50:28 +0200 Subject: [PATCH 21/34] Refactor .gitignore to include new SSH key files --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 8b8c2b6..ce20b2c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,7 @@ repository.vault.* id_rsa +id_ecdsa +id_ed25519 .idea .vscode .terraform* From 50250c57d2a03c1d293436786e4b9f3b71db0552 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 18:56:17 +0200 Subject: [PATCH 22/34] Refactor SSH configuration in ansible-apply.yaml and update playbook execution with ECDSA private key --- ansible/playbook_hardening.yml | 2 -- ansible/roles/cis_hardening/defaults/main/sshd.yml | 2 +- ansible/roles/cis_hardening/tasks/main.yml | 8 ++++++++ ansible/roles/cis_hardening/tasks/sshconfig.yml | 14 ++++++++++++++ 4 files changed, 23 insertions(+), 3 deletions(-) diff --git a/ansible/playbook_hardening.yml b/ansible/playbook_hardening.yml index 2224dd1..985c785 100644 --- a/ansible/playbook_hardening.yml +++ b/ansible/playbook_hardening.yml @@ -19,8 +19,6 @@ tags: - roles - roles::cis - - roles::cis::ufw - - roles::cis::sysctl - role: "fail2ban" tags: - roles diff --git a/ansible/roles/cis_hardening/defaults/main/sshd.yml b/ansible/roles/cis_hardening/defaults/main/sshd.yml index 9ea3268..9131071 100644 --- a/ansible/roles/cis_hardening/defaults/main/sshd.yml +++ b/ansible/roles/cis_hardening/defaults/main/sshd.yml @@ -15,7 +15,7 @@ sshd_client_alive_interval: 200 sshd_compression: "no" sshd_gssapi_authentication: "no" sshd_hostbased_authentication: "no" -sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 +sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com sshd_ignore_user_known_hosts: "yes" sshd_kerberos_authentication: "no" sshd_kex_algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 diff --git a/ansible/roles/cis_hardening/tasks/main.yml b/ansible/roles/cis_hardening/tasks/main.yml index a148ceb..559d6b7 100644 --- a/ansible/roles/cis_hardening/tasks/main.yml +++ b/ansible/roles/cis_hardening/tasks/main.yml @@ -20,9 +20,13 @@ when: ufw_enable tags: - ufw + - roles::cis::ufw - name: Configure sysctl ansible.builtin.include_tasks: sysctl.yml + tags: + - sysctl + - roles::cis::sysctl - name: Disable kernel network modules ansible.builtin.include_tasks: disablenet.yml @@ -76,6 +80,10 @@ - name: Configure ssh server and client ansible.builtin.include_tasks: sshconfig.yml + tags: + - ssh + - sshd + - roles::cis::sshd - name: Configure PAM ansible.builtin.include_tasks: password.yml diff --git a/ansible/roles/cis_hardening/tasks/sshconfig.yml b/ansible/roles/cis_hardening/tasks/sshconfig.yml index 9536dc1..1e2fa03 100644 --- a/ansible/roles/cis_hardening/tasks/sshconfig.yml +++ b/ansible/roles/cis_hardening/tasks/sshconfig.yml @@ -6,6 +6,7 @@ failed_when: false register: ssh_version tags: + - roles::cis::sshd - sshd - sshd_config @@ -13,6 +14,7 @@ ansible.builtin.set_fact: ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing] tags: + - roles::cis::sshd - sshd - sshd_config @@ -21,6 +23,7 @@ path: /etc/sysconfig/sshd register: sysconfig_sshd tags: + - roles::cis::sshd - sshd - sshd_config - M1041 @@ -33,6 +36,7 @@ regexp: ^\s*CRYPTO_POLICY.*$ when: sysconfig_sshd.stat.exists tags: + - roles::cis::sshd - sshd - CCE-80939-2 - M1041 @@ -44,6 +48,7 @@ changed_when: false failed_when: false tags: + - roles::cis::sshd - sshd - sshd_config - M1041 @@ -53,6 +58,7 @@ path: /etc/ssh/sshd_config.d register: sshd_config_d tags: + - roles::cis::sshd - sshd - sshd_config - M1041 @@ -65,6 +71,7 @@ group: root mode: "0600" tags: + - roles::cis::sshd - sshd - sshd_config @@ -83,6 +90,7 @@ - Restart sshd service - Restart ssh service tags: + - roles::cis::sshd - sshd - sshd_config - CCE-80895-6 @@ -137,6 +145,7 @@ - Restart sshd service - Restart ssh service tags: + - roles::cis::sshd - sshd - sshd_config - CCE-80895-6 @@ -184,6 +193,7 @@ state: absent when: sshd_config_d.stat.exists and grep_include.rc == 0 tags: + - roles::cis::sshd - sshd - sshd_config @@ -196,6 +206,7 @@ excludes: "*.pub" register: ssh_host_keys tags: + - roles::cis::sshd - sshd - M1022 - M1041 @@ -211,6 +222,7 @@ loop_control: label: "{{ item.path }}" tags: + - roles::cis::sshd - sshd - CCE-82424-3 - CIS-UBUNTU2004-5.3.2 @@ -222,6 +234,7 @@ path: /etc/ssh/ssh_config.d register: ssh_config_d tags: + - roles::cis::ssh - ssh - ssh_config - M1041 @@ -236,6 +249,7 @@ owner: root group: root tags: + - roles::cis::ssh - ssh - ssh_config - CCE-82880-6 From 754f5eb4bb2a6210080452871bdad43d4a7960c6 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:00:10 +0200 Subject: [PATCH 23/34] Refactor SSH configuration and enable ECDSA host key algorithm --- .github/workflows/ansible-apply.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 0fb008a..3437db4 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -45,6 +45,12 @@ jobs: done chmod 600 ~/.ssh/known_hosts + - name: Enable SSH host key algorithms + run: | + echo "Host *" >> ~/.ssh/config + echo " HostKeyAlgorithms +sk-ecdsa-sha2-nistp256" + chmod 600 ~/.ssh/config + - name: Apply Ansible Playbook env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} From 53239f984338466269bb14fe50fee2d898c7c754 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:01:43 +0200 Subject: [PATCH 24/34] Refactor SSH configuration to enable additional host key algorithms --- .github/workflows/ansible-apply.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 3437db4..0effa83 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -48,7 +48,7 @@ jobs: - name: Enable SSH host key algorithms run: | echo "Host *" >> ~/.ssh/config - echo " HostKeyAlgorithms +sk-ecdsa-sha2-nistp256" + echo " HostKeyAlgorithms +sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com" chmod 600 ~/.ssh/config - name: Apply Ansible Playbook From 0a15a87d36ef6ac175f9a3770045f76a517b2d1b Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:05:46 +0200 Subject: [PATCH 25/34] Refactor SSH configuration and test SSH connection in ansible-apply.yaml --- .github/workflows/ansible-apply.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 0effa83..b87d2ab 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -40,8 +40,8 @@ jobs: TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} run: | mkdir -p ~/.ssh - for host in $TRUSTED_HOSTS; do - ssh-keyscan $host >> ~/.ssh/known_hosts + for HOST in $TRUSTED_HOSTS; do + ssh-keyscan $HOST >> ~/.ssh/known_hosts done chmod 600 ~/.ssh/known_hosts @@ -51,6 +51,15 @@ jobs: echo " HostKeyAlgorithms +sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com" chmod 600 ~/.ssh/config + - name: Check SSH Connection + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + run: | + for HOST in $TRUSTED_HOSTS; do + ssh -vvvv -i ~/.ssh/id_ecdsa $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" + done + - name: Apply Ansible Playbook env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} From 38480c4333ba41dde7d907ac8c3d265018021872 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:07:48 +0200 Subject: [PATCH 26/34] Refactor SSH configuration in ansible-apply.yaml to use TRUSTED_HOSTS secret --- .github/workflows/ansible-apply.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index b87d2ab..2f18840 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -53,7 +53,7 @@ jobs: - name: Check SSH Connection env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} run: | for HOST in $TRUSTED_HOSTS; do From 7859f653287bfeb65796d9b6b3049cf47a9221c9 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:31:44 +0200 Subject: [PATCH 27/34] Refactor SSH configuration and update playbook execution in ansible-apply.yaml --- .github/workflows/ansible-apply.yaml | 20 +++++++++++++++----- ssh-keys/ansible/id_ecdsa.key | 2 +- ssh-keys/ansible/id_ecdsa.pub | 2 +- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 2f18840..0d92184 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -51,13 +51,23 @@ jobs: echo " HostKeyAlgorithms +sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com" chmod 600 ~/.ssh/config + - name: Start SSH Agent + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + ssh-agent -a $SSH_AUTH_SOCK > /dev/null + SSH_PASSWORD="$(sectool vault get SSH_PASSWORD)" + echo 'echo $SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass + DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null + rm ~/.ssh_askpass + - name: Check SSH Connection env: TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} run: | for HOST in $TRUSTED_HOSTS; do - ssh -vvvv -i ~/.ssh/id_ecdsa $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" + ssh -vvvv $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" done - name: Apply Ansible Playbook @@ -66,7 +76,7 @@ jobs: ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml --private-key ~/.ssh/id_ecdsa - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml --private-key ~/.ssh/id_ecdsa - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml --private-key ~/.ssh/id_ecdsa - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml --private-key ~/.ssh/id_ecdsa + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml + # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml + # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml + # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml diff --git a/ssh-keys/ansible/id_ecdsa.key b/ssh-keys/ansible/id_ecdsa.key index de07b68..ef5647c 100644 --- a/ssh-keys/ansible/id_ecdsa.key +++ b/ssh-keys/ansible/id_ecdsa.key @@ -1 +1 @@ -rqj9+32dGlvREkyWG/e8k6MaEjCZn91thFZXnEydovKfdG8J1xnuI0fZiYbPG636r2yPySXkVWglZdKd0x9KLqT06jVDIJI0cPJ0tIi0yHYy04cAtcKFT0L46tXJemjbUX1wrBKyAtzlqBGtEHHFjASFLnhw+rEpP+5jrYMpHh/H0z/ac5eHohXauj9KxGeLLIe2hDDn19mNghnDm0rP+zBWnwx81JYQFMtOL02M+DF3zp5lU1TZ4srzhNUoFHjCzrj/yuksBdWWqP8TcNyzwaFmJW7q/PtX6h/cuwPt8vnLhNo5t5iPr9VL9sTfIjkvdYMErtwHY3m8CHF7naa83NAtPXhAV+74rUjiW0WPGAZDfASql9yVJofwFmn3s0pP1vRwHeJ4NAtHiG9ScR1eI7+B3Sf5bkFM7n4hP23l01NTaKV8UKTHyDuctH+/MeUYAImimSxJNAANr0xyOeluJREn0y3P0DvY8CpPQNcF9LDtUCLM3/2/W2z7p+mkPKtmZscgoEhaEY4Y/N7807cmxcIBLbL5etRpofJ/3EA6zZfrVYK0+amuRMTEtJGLhs5I8t9hHjNprSZU1rtb4ZC4fcvBwtJ5sdP9I89BMhAqzB6PcPLnXm2lTA== \ No newline at end of file +AbAGmrKt/ehNzz1RmUMMH22raJzBuhX8uRd9BAJwpE/VH4xAzNYDRwQETAvhBJxMxBSIU41nxAMkuKGnNK7uMccH4QmtganmzB0E6OqoHafDZ103Pbj4P51nHhOX9RuIHuYqiMMWYW23zweXCTJeOtSGee+LlSisUiDacwrgWbhvaV0PdAkXu4hsxl3DdMUiwd9rYwWTKVTZGqAMk/MljuWkihZd4/uvxH2H0rJLmTyiCIpIuLAiGHkUzmVZN0rQ2TLn12L0ocxBvtZBYWIg8BobgvjS9gFCBrjVfCGNPDI9OVsGPNhvLGfui2Wbq5vrbb74S4K3v6KxsjtCH4b1QHi70L4J8MZlR5b/kYELt411pWjujBZLx0l5KG8wwu/5tUac5e50fgfHJyGRCqyo4TaljZf1m5VXLq2/CYS/q2Q06bJP8NHgy3o7V/O8SsEVWMJC9rW22yXhnytiSkYNdiOPKNmzabg6H0zL7ugIU0g4vBjNEwVHSFP0n6VHQXtaDeDQhFHLWqmvR1jh8cDAApAMRYrf8ALZL14PHUWdEytGDY4KJVOj5Ht8NBAzEhPE5dLIy9S/UpHewQm4J0gvtaUuCffU2GXkmw2BhcvTNcdP9nUJ4i4YoA== \ No newline at end of file diff --git a/ssh-keys/ansible/id_ecdsa.pub b/ssh-keys/ansible/id_ecdsa.pub index d113bdd..ceb1cfd 100644 --- a/ssh-keys/ansible/id_ecdsa.pub +++ b/ssh-keys/ansible/id_ecdsa.pub @@ -1 +1 @@ -ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFBAP7dYOsOGKH1UeyEzWtOv+e46AuJgcN4QiMQdOB9tft2JzR2epd1/e9VDsqN8cGcbIYi6TvsgA+IVtK4bj6wDACt/FHol1L3vV2xK3/dtbu5SEPkkksL8mqB4LXdsepHuapqhVgEanSSysbpRYytcfsy2Rtwi/Wa+8c8+302lTfG3w== +ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAEFj7rNbTqpVSlp1eZgXcZvKrzORkIudgpP6Q6bsDzq/WYEki20p6i8o/QdQVgae6KJP2cfAkxVBUU3Qxlm1Z/ETQGpLEWicy1QE57VIu2d4CWGFsvgVbevJ4vmITnnh0UBQgeAmEL2r8sIl7EwILuevk3GLVtf1E04AFJ08t56mIVMEg== From 6fe89a8e075a1740480e4f8a21a3280ff240ea61 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:34:05 +0200 Subject: [PATCH 28/34] Refactor SSH configuration and add SSH_AUTH_SOCK to ansible-apply.yaml --- .github/workflows/ansible-apply.yaml | 3 +++ repository.vault | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 0d92184..e1f8fac 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -54,6 +54,7 @@ jobs: - name: Start SSH Agent env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | ssh-agent -a $SSH_AUTH_SOCK > /dev/null SSH_PASSWORD="$(sectool vault get SSH_PASSWORD)" @@ -65,6 +66,7 @@ jobs: env: TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | for HOST in $TRUSTED_HOSTS; do ssh -vvvv $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" @@ -74,6 +76,7 @@ jobs: env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | cd ansible sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml diff --git a/repository.vault b/repository.vault index b4c803e..66be9f3 100644 --- a/repository.vault +++ b/repository.vault @@ -1 +1 @@ -/d5vNW1DFG3lFVC+8zR2YFny516calEaKZT1BCxb5azvJd6DL7j39gmPUPXzMzJpNf022gf77mMt+RrsbpZnBEEiYzvurYf03wcnWKID0PdIGctXwdPzH1eqAVHJUvyBnSHxB60E+Kcl+ao/0Al2ZoqgFwtjYVlrdHK3poNeO0WcP59RftBKWEBbw8ru/pht3KaDtgU+u3loNna/vIcf7gUmE7ue/u/pMC5s7rWHjuTKlcaaAOvLLKafjdrcVC9Bw6YrC3/b1qtS8xxSu4MZD97Jemeg2jmtyovDSq1JtwypzeCfctYwirEBVT++pnw75tNqa4iOTWxPTM1+HAi9EFFlIrJG6j3M3QZTsDsu4agEDyB5Mq6/PxaKT0qXKz+KUlLQRzJ6UHE9RjeQY5rOgTy4uB1C4pDMasjesRrlQ0Id2USk/KCRaCGdOe/7xO3D2Fdn1Tpls0H7zBfPjIkzrytuDHbfdWos/aMnPP6Kc4Lta6p+5Vmkpo96/MBJTlrBPHucpTBqYtzzm2O4SXg6/NF/isCZ8+vBQuNg/vTO1cF+j4Z217Oiq+nLJcmrdxBwaHpEsmFtAos7vt3gH6/6kXM7vb92u5EIzlQce9IJcWQbmNH+E3hHjO9Tcj0NOn6ccvhOp4yEe+N0OXeNrW0VF0SMsXCVD+fPaE1EJUBVLFhaMDYR0QLe8Ti6LWI10b5wa4xw4yElu4X5mocw4GgiwzJtqKWH54mvF3eeCgs8aGS+Z7QmnampNrxUialWlV4hZdB/SXt4D0RgsQApyfowUNROwa68rLG7Re/SOefO9K7Hy+M4fMUEaasHT3hV/abkRf2I393FubM/wAOYX8wDQTgSqW97ZcGy3aRVh0h4KXzEa1h/rx3OHiFMHkQMxph3ScG0BRYM+LJmirI5v3LZ9hxnq2aZBekJG9lR88tYgwlZYsp8iyPcctlp8WDs+wVDuTj6pm0fZexrOweLz5VzlEm/jUJUaV0KFQHg7xmwi2RJqP3u8wofktEyYxEKbD3P18nyCCSmPJhIA8QDwwtKyGIFM6s9U1W6nZIR5HVqRzo/bL1y90VQEeOsIKgnrIoRIDfSqKX4fyK/Gdbxxz8kOB/WZtHCFrnQfqhT4dYK+zY9RA04n5PZzRmbbv9RtBYduYDW0zEBxT5+iBsophtMjMZ5jpiZ9AtErMuW6xP4mO8IPoLbId/8ktRm0R655r96soTas1+LlT1LDFUv6cO+S9f0n5kibjwPM3hKt5/U69wY4Qqo3Oey+ghVNXHGbuc4DgjF0lizkl9qU4hhsbr3A6G99uWVGcTI+cospKT064Xi4icZcUJcfBdxLoA09rtHkb+7ZbFDVXNWrAHTqByn30k7fY4FBjMcGuV7JJNyGbDz1zXIsP8J7XUcNuLEP6A4fFxzOn/jQcojgiSVTaLMXfNE02ER7jiYvbF/tDOkqDlpQE5qlGhsvtyPkILBDyVrT4KGiTzNE4rT+WfopIYea1SXUE4WI6/xWkCYpedrqduLYnfl+Rqwmg31GomNfO3NVu6n+Gv5BGOW4Ssg+1DSdOZudFChA7jTzZCbj13VhIGUg67qxCZqvWIkymoKSpgmstsq0ChU+xAYlfkGEuAalIgAITHWov1xyY0qjVXJ988csuIoGZWXaCDMbqBxZHmz5XiUuyZghyQ00h2gUcHPvKSq/dDGaW0AfdX/N8qLVL9pmZLK/uUfaBYte0RYwacR5zoFdIUurhSVitVSn6rIOEIOJv2Ej0gDop/xgl1/n0hKQ8/Zk0We/VU9XAE2VTxLsgAalDgwtt2W7W2IhmkdM4pj1MAZxisU45js0Yh5T2APEB7brnsNi1LDFvLoYsoYqyVi5uFqnM1yKUUGU+jc0ug90Wi1EBgkOy/aK3JDwW/Db7Twk9EdHupepcIAeggbsNa4KOSGPS5U5zxhjshwuMfw0MyZrZHrVTDqAI6VQxniMk6uK8xu+bfP98CMljX3oV9MhSRey7+Ko+474RahmnQmljcik/VPDNMVq2tlNXxZnnI6/sy/Orc1Ecq18+xMtcwVrCY5se974J8ag1g71YK+bP63CQXuMbG3r83s2T8t8ScLtui9EFx0JOXNbGHJrRoomdgISBLoHEAulaiTWUaXpmXOtNCSXSQ42lQ= \ No newline at end of file +lZE/F/Ng+kqQG65u5afRAODt626sHUV/sS13AsWpx6AlWOf40hrq9QNnkjAq1fF8FVctnyY+ltBjwc7fAmvqlwWmbVclahnwQFbgjQ24c6IYuMMmULEy9PN6iPBFH1EstA8lrSVNCz+AN1NR0yxctAMMv7/XoAo6e6nOsn3Ko5F4M57L8QSdoEI/Giz2UvVm46teibFDivnfgjKji3oWO5xIcy7ggZsDF4pYZLci3THfgonoBPZUxyehVl/uyarT0k0LIUD6QUCNXaxxQXa2rDsgyoglLOUZRvitdoThXJsW4VjKYD/joJdR1bELwJ41Nh6IPcWsUSJrEJHhr3IEBMk6DKkC96Ie1kOvW8GkHOKkmFdZkhr2gj9ol6xB8XD/x6K6hZnW/BdJnD3F1JX05km3UHW4uSgvrN1l4x1nNZ5w84BQ/mw1M90ZoiCDjFBtQUOIYciFMQTkbUNnnvDigRXzLhcqxEMJnZ1saz6YXA86WDTxNU5AlOAiwtn4MpO7obXOaiclscB1smpFosjVUqKPpuJrNC5RehhXYVsSdqLk5nRYokv866/RQmXOXzNeig9DrJvj0+Da5kcQ12gWEKr6gSG4O8QLcUcP+YnDtPOaq6OpzEzVmYB9XboOZQyumiUn3QL0jwINBwbNM2GLvXHt5Mmhd16dcHbabZAqLzHRy5T2bh8jhcgRVORem9IOVOSIhCnv7szt+mfEzem5ipUx8dQljOFodNRf5YiJHuWS4yEsbsvV4dLdIqWwMasA1YsOjzRnu5w0AJjd5mo3v9zFW/1kop+tFcsPbglr/Tm9uH9a7D1gZnkZLlUILhC+edRPde5upIyQkrdm7WLECkXsBqQz3QhbcD9BW2krFgvdjyDJYGSpFnXXtsOoo/+NnQd+IRiSe2aevVQH6MrUqfeQ0l/Wxi2cpxTIMLhKnmkRkrSqOn3/EpVL62eJPCmW4OSyCISexIxVvsx72WhvlAMLDXfPxC7zTObUtlrd3w+kzIF8K3ZduRUHWwtCSSekhzTJ3JZyGxKZ88sPfUtk7n1J/lmFVCmHmkuU+Rw21PEVPepPL1tkBURk12uH/+uyRFfR7zFEXXC39nXyKN/Yxa+z0Tdhj2mynLbuZ6ygwfEqXM1hyScqTh1J4z6CDLMelE+kEgvNxG1n8fXC75KPsaxzsqwqlo90CDNNrs2loJrxm3kQcqXxowy/sLtupHpdufEPP6hHnPptqsndmiNiqZjLgmCGuMR3KZBxrv2nsmwdnT4V/aDf80m3lRSuhjZD4zhRIhxsIRKlMjjAi7qgeHFBrOS61J/VVwtzxgLZFfEnPM8M3nf3wh/gAEzTa1uWiJxO26UDUymoW18YWOoIQDn0vjN3acLtGcy+mbjHYWHoJ2So0hjuDJ6ItGKfvrqDwjKX6grGXi955JhVPdR4wh6K+zoYqNS0uFVXc4hJZnr9R7xfPE5QjjNQqJLCZzgkX0sA28qL/5lzzr7XNkfotz0muyvO5OvfBJdcYyjTg5A7fZT0OvbM1dc8pmXzU1+dZnf/ByVemm81rBGBxhlcLIszqGhQzL9Is6dWzHChLA5moQSlKDvcjgUhuB/nV2FKi6kXqp5xU07i1kcbG6b4JL2fA4+ad71odxmE8SYmXt3PZFqJJIAmdVIAXdHeUQZlaA/wEbB9RdlD7XrGVc30BnYg2UA5AO2ijPECuScsZ+QmGBU/pzgp5mLZ691CyvnS9YtDuK3t1c1aNAOMpw9ZLmY5DINzmXuKtLHCw/HCUAH8+Zj94IXJKWYl1CmcxWH2prTDdbjOv5FpckQq04YCykx9qEr8tlq+LBkYB5r7DzzZfemb9YPKapqDXOTJVYBZP35QWPd2xHJVSE9KnYUpgfPxrYpEeJRBvPODOt1pxu+HOiiljSB3H5WBPlS91w1TcQZCE0g9VL+ERmoCOOso0PSI9F2LquLPA6sVlcxMXP9ouZ5BkkSxrOkc/3iLrINHaXRHirfNJLzDePe+xxLJCzXVDeFqUzd8iZO71E5fiGBzwpefnBnfa/bEF/SXfiFl491rYx8Wrur11QmaiHpMPdTsF1YknrE9HU4eYu3wT+7GgeIpX0KN3iT2RFPj9BztT5JBj8LefK3KSzRqc4E3Oak6WEfulkAOguOPJI3FOoXod/trve2kiReSTJlCEcK1FtOStE9yN0vRLM8= \ No newline at end of file From ce8bc0e3b704af0cc0af558de47505db07fceaf2 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:40:15 +0200 Subject: [PATCH 29/34] Refactor SSH configuration to read SSH Trusted Hosts keys --- .github/workflows/ansible-apply.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index e1f8fac..561f179 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -35,7 +35,7 @@ jobs: cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa chmod 600 ~/.ssh/id_ecdsa - - name: Configure SSH to Disable Host Key Checking + - name: Read SSH Trusted Hosts keys env: TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} run: | From fe6fdf6d575697a26a482efdfb3f742baeb7f7bc Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:42:56 +0200 Subject: [PATCH 30/34] Refactor SSH configuration in ansible-apply.yaml to remove SSH_PASSWORD usage --- .github/workflows/ansible-apply.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 561f179..73973af 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -57,8 +57,7 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | ssh-agent -a $SSH_AUTH_SOCK > /dev/null - SSH_PASSWORD="$(sectool vault get SSH_PASSWORD)" - echo 'echo $SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass + echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null rm ~/.ssh_askpass From 05e0a66919c16a095e8abd934c874ad9ac6fc0b1 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 19:55:00 +0200 Subject: [PATCH 31/34] Refactor SSH configuration and update playbook execution in ansible-apply.yaml --- .github/workflows/ansible-apply.yaml | 8 +- ansible/playbook_kvm.yml | 3 - ansible/playbook_microk8s.yml | 2 - ansible/roles/cis_hardening/tasks/main.yml | 90 ++++++++++++++++++---- requirements.txt | 1 + 5 files changed, 82 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 73973af..55978d2 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -68,7 +68,7 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | for HOST in $TRUSTED_HOSTS; do - ssh -vvvv $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" + ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" done - name: Apply Ansible Playbook @@ -79,6 +79,6 @@ jobs: run: | cd ansible sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml - # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml - # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml - # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml + sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml diff --git a/ansible/playbook_kvm.yml b/ansible/playbook_kvm.yml index bf4b2d2..1d4f932 100644 --- a/ansible/playbook_kvm.yml +++ b/ansible/playbook_kvm.yml @@ -19,8 +19,6 @@ tags: - roles - roles::cis - - roles::cis::ufw - - roles::cis::sysctl - role: "fail2ban" tags: - roles @@ -33,7 +31,6 @@ tags: - roles - roles::duosecurity - - role: "virtualization" tags: - role::virtualization diff --git a/ansible/playbook_microk8s.yml b/ansible/playbook_microk8s.yml index 286c107..aab7d42 100644 --- a/ansible/playbook_microk8s.yml +++ b/ansible/playbook_microk8s.yml @@ -19,8 +19,6 @@ tags: - roles - roles::cis - - roles::cis::ufw - - roles::cis::sysctl - role: "fail2ban" tags: - roles diff --git a/ansible/roles/cis_hardening/tasks/main.yml b/ansible/roles/cis_hardening/tasks/main.yml index 559d6b7..c22deba 100644 --- a/ansible/roles/cis_hardening/tasks/main.yml +++ b/ansible/roles/cis_hardening/tasks/main.yml @@ -19,145 +19,209 @@ PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin when: ufw_enable tags: - - ufw - roles::cis::ufw - name: Configure sysctl ansible.builtin.include_tasks: sysctl.yml tags: - - sysctl - roles::cis::sysctl - name: Disable kernel network modules ansible.builtin.include_tasks: disablenet.yml + tags: + - roles::cis::modules - name: Disable file system kernel modules ansible.builtin.include_tasks: disablefs.yml + tags: + - roles::cis::modules - name: Disable IPv6 ansible.builtin.include_tasks: ipv6.yml when: disable_ipv6 + tags: + - roles::cis::ipv6 - name: Configure systemd system and users ansible.builtin.include_tasks: systemdconf.yml + tags: + - roles::cis::users - name: Configure systemd journald and logrotate ansible.builtin.include_tasks: journalconf.yml + tags: + - roles::cis::log - name: Configure systemd timesyncd ansible.builtin.include_tasks: timesyncd.yml + tags: + - roles::cis::systemd - name: Clean fstab ansible.builtin.include_tasks: fstab.yml + tags: + - roles::cis::fstab - name: Configure shm and tmp mounts ansible.builtin.include_tasks: mount.yml + tags: + - roles::cis::mounts - name: Disable prelink ansible.builtin.include_tasks: prelink.yml + tags: + - roles::cis::prelink - name: Configure package managers, update caches and install updates ansible.builtin.include_tasks: packagemgmt.yml + tags: + - roles::cis::packages - name: Configure hosts.allow and hosts.deny when: not custom_hosts_acls ansible.builtin.include_tasks: hosts.yml + tags: + - roles::cis::hosts - name: Configure login.defs ansible.builtin.include_tasks: logindefs.yml + tags: + - roles::cis::logindefs - name: Set limits ansible.builtin.include_tasks: limits.yml + tags: + - roles::cis::limits - name: Configure adduser and useradd ansible.builtin.include_tasks: adduser.yml + tags: + - roles::cis::adduser - name: Restrict root access ansible.builtin.include_tasks: rootaccess.yml + tags: + - roles::cis::root - name: Configure needrestart, install and remove various packages ansible.builtin.include_tasks: packages.yml + tags: + - roles::cis::packages - name: Configure ssh server and client ansible.builtin.include_tasks: sshconfig.yml tags: - - ssh - - sshd - roles::cis::sshd + - roles::cis::ssh - name: Configure PAM ansible.builtin.include_tasks: password.yml + tags: + - roles::cis::pam - name: Configure and clean at and cron ansible.builtin.include_tasks: cron.yml + tags: + - roles::cis::cron - name: Disable systemd ctrl-alt-del.target ansible.builtin.include_tasks: ctrlaltdel.yml + tags: + - roles::cis::ctrlaltdel - name: Configure auditd ansible.builtin.include_tasks: auditd.yml + tags: + - roles::cis::auditd - name: Configure AppArmor ansible.builtin.include_tasks: apparmor.yml + tags: + - roles::cis::apparmor - name: Disable misc kernel modules ansible.builtin.include_tasks: disablemod.yml + tags: + - roles::cis::modules - name: Disable wireless interfaces ansible.builtin.include_tasks: disablewireless.yml when: disable_wireless - -# https://bugs.launchpad.net/ubuntu/+source/aide/+bug/1903298 -- name: Configure AIDE - ansible.builtin.include_tasks: aide.yml - when: > - install_aide | bool and - (not (ansible_os_family == "Debian" and - (ansible_lsb.codename == "groovy" or - ansible_lsb.codename == "hirsute"))) + tags: + - roles::cis::wireless - name: Manage users ansible.builtin.include_tasks: users.yml + tags: + - roles::cis::users - name: Remove suid/sgid permissions ansible.builtin.include_tasks: suid.yml when: suid_sgid_permissions | bool + tags: + - roles::cis::suid - name: Configure compiler permissions ansible.builtin.include_tasks: compilers.yml + tags: + - roles::cis::compilers - name: Set umask ansible.builtin.include_tasks: umask.yml + tags: + - roles::cis::umask - name: Configure paths ansible.builtin.include_tasks: path.yml + tags: + - roles::cis::path - name: Configure systemd logind ansible.builtin.include_tasks: logindconf.yml + tags: + - roles::cis::logind - name: Configure rkhunter ansible.builtin.include_tasks: rkhunter.yml + tags: + - roles::cis::rkhunter - name: Add issue message ansible.builtin.include_tasks: issue.yml + tags: + - roles::cis::issue - name: Configure apport ansible.builtin.include_tasks: apport.yml + tags: + - roles::cis::apport - name: Lock root account ansible.builtin.include_tasks: lockroot.yml + tags: + - roles::cis::root - name: Configure Postfix ansible.builtin.include_tasks: postfix.yml + tags: + - roles::cis::postfix - name: Configure motdnews ansible.builtin.include_tasks: motdnews.yml + tags: + - roles::cis::motdnews - name: Configure sudo ansible.builtin.include_tasks: sudo.yml + tags: + - roles::cis::sudo - name: Miscellaneous extra tasks ansible.builtin.include_tasks: extras.yml + tags: + - roles::cis::extras - name: Miscellaneous tasks after all handlers ansible.builtin.include_tasks: post.yml + tags: + - always \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index e387765..bfad3dc 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,3 +1,4 @@ ansible ansible-lint ansible-playbook-grapher +passlib From 8a43e2e301c6bf46677d989ee4971608dd9de98e Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 20:14:45 +0200 Subject: [PATCH 32/34] Refactor SSH configuration and playbook execution in ansible-apply.yaml --- .github/workflows/ansible-apply.yaml | 2 ++ ansible/playbook_microk8s.yml | 23 ----------------------- ansible/playbook_nextcloud.yml | 8 ++++---- ansible/roles/microk8s/tasks/roles.yml | 0 4 files changed, 6 insertions(+), 27 deletions(-) delete mode 100644 ansible/roles/microk8s/tasks/roles.yml diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 55978d2..fdb01ff 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -78,6 +78,8 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | cd ansible + # Currently, the playbook_hardening.yml is failing due to the aide package and UFW + # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml diff --git a/ansible/playbook_microk8s.yml b/ansible/playbook_microk8s.yml index aab7d42..19beff6 100644 --- a/ansible/playbook_microk8s.yml +++ b/ansible/playbook_microk8s.yml @@ -4,33 +4,10 @@ gather_facts: true roles: - - role: "bootstrap" - tags: - - roles - - roles::bootstrap - role: "manage_users" tags: - roles - roles::users - - role: "cis_hardening" - vars: - # currently aide is failing - install_aide: false - tags: - - roles - - roles::cis - - role: "fail2ban" - tags: - - roles - - roles::fail2ban - - role: "geoip" - tags: - - roles - - roles::geoip - - role: "duo_security" - tags: - - roles - - roles::duosecurity - role: "microk8s" tags: - role::microk8s diff --git a/ansible/playbook_nextcloud.yml b/ansible/playbook_nextcloud.yml index aa61c21..d111b8c 100644 --- a/ansible/playbook_nextcloud.yml +++ b/ansible/playbook_nextcloud.yml @@ -10,9 +10,9 @@ nextcloud_home: "/var/lib/nextcloud" nextcloud_mysql_home: "/var/lib/mysql.nextcloud" nextcloud_user_id: 33 - nextcloud_group_id: 26 - mysql_user_id: 999 - mysql_group_id: 107 + nextcloud_group_id: 33 + mysql_user_id: 0 + mysql_group_id: 0 tags: always - name: Create required nextcloud data folder @@ -32,7 +32,7 @@ ansible.builtin.file: state: directory path: "{{ nextcloud_mysql_home }}" - mode: "0750" + mode: "0755" owner: "{{ mysql_user_id }}" group: "{{ mysql_group_id }}" tags: diff --git a/ansible/roles/microk8s/tasks/roles.yml b/ansible/roles/microk8s/tasks/roles.yml deleted file mode 100644 index e69de29..0000000 From 9278fe47f2b8278d7402c41214aa3534a5ec209a Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 20:48:45 +0200 Subject: [PATCH 33/34] Refactor Microk8s plugin configuration and disable ha-cluster plugin --- ansible/roles/microk8s/tasks/microk8s/install.yml | 2 +- ansible/roles/microk8s/tasks/microk8s/plugins.yml | 2 +- ansible/roles/microk8s/tasks/setupenv/main.yml | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ansible/roles/microk8s/tasks/microk8s/install.yml b/ansible/roles/microk8s/tasks/microk8s/install.yml index 6c79627..0f40dcf 100644 --- a/ansible/roles/microk8s/tasks/microk8s/install.yml +++ b/ansible/roles/microk8s/tasks/microk8s/install.yml @@ -57,7 +57,7 @@ - name: Microk8s | Required plugins (microk8s) ansible.builtin.include_tasks: microk8s/plugins.yml loop: - - { plugin: "ha-cluster", wait: 90, args: "", enabled: false } + - { plugin: "ha-cluster", wait: 30, args: "--force", enabled: false } - { plugin: "rbac", wait: 30, args: "", enabled: true } - { plugin: "dns", wait: 30, args: "", enabled: true } - { plugin: "storage", wait: 10, args: "", enabled: true } diff --git a/ansible/roles/microk8s/tasks/microk8s/plugins.yml b/ansible/roles/microk8s/tasks/microk8s/plugins.yml index bd35ba9..ef7b614 100644 --- a/ansible/roles/microk8s/tasks/microk8s/plugins.yml +++ b/ansible/roles/microk8s/tasks/microk8s/plugins.yml @@ -27,7 +27,7 @@ ansible.builtin.set_fact: micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}" - - name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when + - name: Disable plugin '{{ item.plugin }}' # noqa no-changed-when ansible.builtin.command: cmd: "microk8s.disable {{ micro_k8s_args }}" diff --git a/ansible/roles/microk8s/tasks/setupenv/main.yml b/ansible/roles/microk8s/tasks/setupenv/main.yml index a512388..3a29c3b 100644 --- a/ansible/roles/microk8s/tasks/setupenv/main.yml +++ b/ansible/roles/microk8s/tasks/setupenv/main.yml @@ -33,6 +33,7 @@ tags: - k8s::users changed_when: false + ignore_errors: true - name: Configure user access when: item.enabled and secret_exists.stdout != "0" From 5ea3ad7b3decf1dfd3ed427b40a1e539e2084d7a Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 21:22:38 +0200 Subject: [PATCH 34/34] Refactor SSH configuration and playbook execution in ansible-apply.yaml --- .github/workflows/terraform-k8apps-apply.yaml | 58 +++++++++++++++++- .../workflows/terraform-k8apps-validate.yaml | 60 ++++++++++++++++++- 2 files changed, 114 insertions(+), 4 deletions(-) diff --git a/.github/workflows/terraform-k8apps-apply.yaml b/.github/workflows/terraform-k8apps-apply.yaml index 909ede8..c939cfe 100644 --- a/.github/workflows/terraform-k8apps-apply.yaml +++ b/.github/workflows/terraform-k8apps-apply.yaml @@ -6,6 +6,7 @@ on: - main paths: - "terraform/k8sapps/**" + - .github/workflows/terraform-k8apps-apply.yaml jobs: apply: @@ -22,8 +23,61 @@ jobs: - name: Setup Sectool uses: a13labs/setup-sectool@v1 - with: - version: 0.0.3 + + - name: Install Python and required packages + run: | + sudo apt-get update + sudo apt-get install -y python3-pip + python3 -m pip install -r requirements.txt + + - name: Setup SSH Key + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + sectool ssh unlock ansible + mkdir -p ~/.ssh + chmod 700 ~/.ssh + cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa + chmod 600 ~/.ssh/id_ecdsa + + - name: Read SSH Trusted Hosts keys + env: + TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} + run: | + mkdir -p ~/.ssh + for HOST in $TRUSTED_HOSTS; do + ssh-keyscan $HOST >> ~/.ssh/known_hosts + done + chmod 600 ~/.ssh/known_hosts + + - name: Start SSH Agent + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock + run: | + ssh-agent -a $SSH_AUTH_SOCK > /dev/null + echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass + DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null + rm ~/.ssh_askpass + + - name: Check SSH Connection + env: + TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} + ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock + run: | + for HOST in $TRUSTED_HOSTS; do + ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" + done + + - name: Copy Kube Config from remote host + env: + ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock + run: | + mkdir -p ~/.kube + ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s - name: Terraform Init env: diff --git a/.github/workflows/terraform-k8apps-validate.yaml b/.github/workflows/terraform-k8apps-validate.yaml index 7cb214f..1e6b6c0 100644 --- a/.github/workflows/terraform-k8apps-validate.yaml +++ b/.github/workflows/terraform-k8apps-validate.yaml @@ -6,12 +6,13 @@ on: - main paths: - "terraform/k8sapps/**" + - .github/workflows/terraform-k8apps-validate.yaml types: - opened - synchronize - reopened jobs: - plan: + apply: runs-on: ubuntu-latest steps: @@ -26,6 +27,61 @@ jobs: - name: Setup Sectool uses: a13labs/setup-sectool@v1 + - name: Install Python and required packages + run: | + sudo apt-get update + sudo apt-get install -y python3-pip + python3 -m pip install -r requirements.txt + + - name: Setup SSH Key + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + sectool ssh unlock ansible + mkdir -p ~/.ssh + chmod 700 ~/.ssh + cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa + chmod 600 ~/.ssh/id_ecdsa + + - name: Read SSH Trusted Hosts keys + env: + TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} + run: | + mkdir -p ~/.ssh + for HOST in $TRUSTED_HOSTS; do + ssh-keyscan $HOST >> ~/.ssh/known_hosts + done + chmod 600 ~/.ssh/known_hosts + + - name: Start SSH Agent + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock + run: | + ssh-agent -a $SSH_AUTH_SOCK > /dev/null + echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass + DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null + rm ~/.ssh_askpass + + - name: Check SSH Connection + env: + TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} + ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock + run: | + for HOST in $TRUSTED_HOSTS; do + ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" + done + + - name: Copy Kube Config from remote host + env: + ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + SSH_AUTH_SOCK: /tmp/ssh_agent.sock + run: | + mkdir -p ~/.kube + ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s + - name: Terraform Init env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} @@ -33,7 +89,7 @@ jobs: cd terraform/k8sapps sectool exec terraform init - - name: Terraform Plan + - name: Terraform Apply env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: |