{"id":14984460,"url":"https://github.com/moltenbit/how-to-secure-a-linux-server-with-ansible","last_synced_at":"2025-07-07T16:39:58.163Z","repository":{"id":176832471,"uuid":"659384200","full_name":"moltenbit/How-To-Secure-A-Linux-Server-With-Ansible","owner":"moltenbit","description":"Ansible playbooks of \"How To Secure A Linux Server\".","archived":false,"fork":false,"pushed_at":"2024-08-06T20:24:35.000Z","size":33,"stargazers_count":133,"open_issues_count":6,"forks_count":23,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-03-24T16:11:06.928Z","etag":null,"topics":["ansible","ansible-playbook","ansible-role","ansible-roles","hardening","hardening-steps","linux","linux-server","security","security-hardening","server"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc-by-sa-4.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/moltenbit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-27T18:04:29.000Z","updated_at":"2025-03-10T04:18:05.000Z","dependencies_parsed_at":null,"dependency_job_id":"51d56602-9b56-4004-a7e4-df3ce2b378bb","html_url":"https://github.com/moltenbit/How-To-Secure-A-Linux-Server-With-Ansible","commit_stats":{"total_commits":19,"total_committers":4,"mean_commits":4.75,"dds":"0.26315789473684215","last_synced_commit":"37315ab363a03ba6bbef566c04e06cc2ba6c2884"},"previous_names":["sysadt/how-to-secure-a-linux-server-with-ansible","moltenbit/how-to-secure-a-linux-server-with-ansible"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moltenbit%2FHow-To-Secure-A-Linux-Server-With-Ansible","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moltenbit%2FHow-To-Secure-A-Linux-Server-With-Ansible/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moltenbit%2FHow-To-Secure-A-Linux-Server-With-Ansible/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moltenbit%2FHow-To-Secure-A-Linux-Server-With-Ansible/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/moltenbit","download_url":"https://codeload.github.com/moltenbit/How-To-Secure-A-Linux-Server-With-Ansible/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248271781,"owners_count":21075800,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-playbook","ansible-role","ansible-roles","hardening","hardening-steps","linux","linux-server","security","security-hardening","server"],"created_at":"2024-09-24T14:09:05.936Z","updated_at":"2025-04-10T18:31:43.198Z","avatar_url":"https://github.com/moltenbit.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# How To Secure A Linux Server With Ansible\nAnsible playbooks of [\"How To Secure A Linux Server\"](https://github.com/imthenachoman/How-To-Secure-A-Linux-Server).\n\nThese Ansible playbooks are made to help install secure Linux servers faster.\n\n## How to get started\n1. Install [Ansible](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html)\n2. git clone this repository\n  ```\n  git clone https://github.com/moltenbit/How-To-Secure-A-Linux-Server-With-Ansible\n  cd How-To-Secure-A-Linux-Server-With-Ansible\n  ```\n \n4. [Create SSH-Public/Private-Keys](https://github.com/imthenachoman/How-To-Secure-A-Linux-Server#ssh-publicprivate-keys)\n  ```\n  ssh-keygen -t ed25519\n  ```\n   \n5. Change all variables in *group_vars/variables.yml* according to your needs.\n6. Enable SSH root access before running the playbooks:\n   \n  ```\n  nano /etc/ssh/sshd_config\n  [...]\n  PermitRootLogin yes\n  [...]\n  ```\n\n7. Recommended: configure static IP address on your system.\n8. Add your systems IP address to *hosts.yml*.\n\n\u0026nbsp;\n\nRun the requirements playbook using the root password you specified while installing the server:\n\n    ansible-playbook --inventory hosts.yml --ask-pass requirements-playbook.yml\n\n\u0026nbsp;\n\nRun the main playbook with the new users password you specified in the *variables.yml* file:\n\n    ansible-playbook --inventory hosts.yml --ask-pass main-playbook.yml\n\n\u0026nbsp;\n\nIf you need to run the playbooks multiple times remember to use the SSH key and the new SSH port:\n\n    ansible-playbook --inventory hosts.yml -e ansible_ssh_port=SSH_PORT --key-file /PATH/TO/SSH/KEY main-playbook.yml\n\n\u0026nbsp;\n\nTested on Debian 12 Bookworm.\n\n## Configurations\nThe playbook uses most of the settings from [\"How To Secure A Linux Server\"](https://github.com/imthenachoman/How-To-Secure-A-Linux-Server) / my choices if the guide has more than one option to do something.\n\n### Requirements\n- sudo installed\n- groups created for *sshusers*, *sudousers* and *suusers*\n- new user created with the name specified in *variables.yml* and added to groups\n- use of sudo limited to sudousers group\n- use of su limited to suusers group\n- passwordless sudo enabled for the new user\n- SSH public key added to authorized_keys file\n\n### auditd\nUses best practice rules from [Neo23x0](https://github.com/Neo23x0) \n\n### ClamAV\nClamAV is set to run everyday at 3 AM to scan the full system, exluding sys folders.\n\n### Firewall: UFW\nUFW is set to default deny in and out. \nThe SSH-Port is set to *limit in*, allowed outgoing ports by default are 53 (DNS), 123 (NTP), 80 (http), 443 (https) and the mail port specified in *variables.yml*.\n\n### Firewall: PSAD and Fail2Ban\nPSAD and Fail2Ban is configured according to \"How To Secure A Linux Server\" guide.\n\n### Lynis\nLynis is configured according to \"How To Secure A Linux Server\" guide and will run an audit + send the report as an attachment to your mail address configured in *variables.yml*.\nCurrent Lynis rating is 77.\n\n### Mail\nFor mailing I chose msmtp with the help from [Decatec's guide](https://decatec.de/linux/linux-einfach-e-mails-versenden-mit-msmtp/). This will send a testmail.\n\n### Packages\nInstalled packages are:\n- apt-transport-https\n- ca-certificates\n- host\n- kbtin\n- ntp\n- libpam-pwquality\n- unattended-upgrades\n- apt-listchanges\n- apticron\n- ufw\n- psad\n- fail2ban\n- msmtp\n- msmtp-mta\n- mailutils\n- clamav\n- clamav-freshclam\n- clamav-daemon\n- rkhunter\n- auditd\n- audispd-plugins\n\n### Password quality\nPassword quality is done via pam_pwquality according to \"How To Secure A Linux Server\" guide.\n\n### Rkhunter\nRkhunter is configured according to \"How To Secure A Linux Server\" guide.\n\n### SSH\nSSH is configured according to \"How To Secure A Linux Server\" guide.\n\n### Unattended upgrades\nUnattended upgrades is configured to only upgrade security upgrades automatically. Automatic restarts are enabled.\n\n## Plans / ToDos\n- [ ] use Ansible vault to securely store secrets\n\n## Warning!\nRead all tasks carefully and make sure they do not break your system before using these playbooks! Do not rely solely on the Ansible playbooks for security! It is your responsibility to make sure all settings you need have been set and are working. This is just a starting point! Depending on your needs and goals make sure to further secure your system.\n\n## Credits\n- [imthenachoman](https://github.com/imthenachoman) for creating the great [How To Secure A Linux Server](https://github.com/imthenachoman/How-To-Secure-A-Linux-Server) guide\n- [Neo23x0](https://github.com/Neo23x0) for the auditd best practice rules\n- [Decatec](https://decatec.de/linux/linux-einfach-e-mails-versenden-mit-msmtp/) for the easy mail configuration\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoltenbit%2Fhow-to-secure-a-linux-server-with-ansible","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoltenbit%2Fhow-to-secure-a-linux-server-with-ansible","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoltenbit%2Fhow-to-secure-a-linux-server-with-ansible/lists"}