https://github.com/mist941/basic-server-configuration
An Ansible playbook for automating secure server setup and configuration with sensible defaults for systems.
https://github.com/mist941/basic-server-configuration
ansible devops linux server system-administration system-administration-tool tools
Last synced: 6 months ago
JSON representation
An Ansible playbook for automating secure server setup and configuration with sensible defaults for systems.
- Host: GitHub
- URL: https://github.com/mist941/basic-server-configuration
- Owner: mist941
- License: unlicense
- Created: 2025-03-31T08:51:59.000Z (10 months ago)
- Default Branch: main
- Last Pushed: 2025-04-13T06:29:28.000Z (9 months ago)
- Last Synced: 2025-07-29T03:06:02.857Z (6 months ago)
- Topics: ansible, devops, linux, server, system-administration, system-administration-tool, tools
- Language: Shell
- Homepage:
- Size: 45.9 KB
- Stars: 196
- Watchers: 1
- Forks: 16
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Basic Server Configuration
An Ansible playbook for automating secure server setup and configuration with sensible defaults for systems.
## 🚀 Features
- **System Updates**: Keeps your servers up-to-date with the latest security patches
- **Logging & Reporting**:
- Configures system logging with rsyslog
- Sets up log rotation with logrotate
- Generates HTML execution reports
- Maintains detailed Ansible logs
- **User Management**: Creates a secure non-root user with sudo privileges
- **SSH Hardening**: Configures SSH for key-based authentication only
- **Firewall Setup**: Installs and configures UFW with secure defaults
- **Security Enhancements**:
- Fail2ban for intrusion prevention
- Automatic security updates
- Sensible security defaults
- **Time Synchronization**: Configures NTP for accurate system time
- **Essential Packages**: Installs common utilities (vim, curl, htop, git, mtr)
## 📋 Prerequisites
- Ansible 2.9+
- SSH key pair
- Target Ubuntu servers
- Local environment variables
## 🔧 Setup & Configuration
1. Clone this repository:
```
git clone https://github.com/yourusername/basic-server-configuration.git
cd basic-server-configuration
```
2. Configure environment variables in the `.env` file, you can follow the sample file provided and fill in your data
3. Update the `inventory.ini` file with your server IP addresses:
```ini
[servers]
192.168.1.10
192.168.1.11
# Add your servers here
```
4. Run the playbook:
```
./run.sh
```
## 🛡️ What Gets Configured
- Creates a new sudo user with SSH key authentication
- Disables SSH password authentication and root login
- Configures firewall (UFW) to allow only SSH
- Sets up Fail2ban to prevent brute-force attacks
- Configures automatic security updates
- Installs essential system utilities
- Sets timezone to Europe/Kyiv (configurable)
- Configures comprehensive system logging with rsyslog
- Sets up log rotation to manage log file sizes
- Creates a dedicated directory for application logs
- Implements basic log monitoring for large log files
- Generates detailed HTML reports for each playbook run
## ⚙️ Customization
The playbook has been modularized into roles for better organization and maintainability. To customize:
- **System Updates**: Edit `roles/system_updates/tasks/main.yml`
- **Logging Setup**: Edit `roles/logging_setup/tasks/main.yml`
- Modify rsyslog configuration in `roles/logging_setup/templates/rsyslog.conf.j2`
- Adjust log rotation settings in `roles/logging_setup/files/logrotate.conf`
- **Time Configuration**: Edit `roles/time_configuration/tasks/main.yml`
- **SSH Setup**: Edit `roles/ssh_setup/tasks/main.yml`
- **User Management**: Edit `roles/user_management/tasks/main.yml`
- **Package Installation**: Edit `roles/package_installation/tasks/main.yml`
- **Security Setup**: Edit `roles/security_setup/tasks/main.yml`
- **Automatic Updates**: Edit `roles/automatic_updates/tasks/main.yml`
Common customizations:
- Change the timezone: Edit the timezone task in `roles/time_configuration/tasks/main.yml`
- Modify the package list: Edit the package list in `roles/package_installation/tasks/main.yml`
- Adjust security settings: Edit the security settings in `roles/security_setup/tasks/main.yml`
- Configure logging:
- Enable remote logging: Uncomment and configure the remote logging line in `roles/logging_setup/templates/rsyslog.conf.j2`
- Change log rotation frequency: Modify rotation settings in `roles/logging_setup/files/logrotate.conf`
- Add custom application logs: Add new log paths in both rsyslog and logrotate configurations
- Add or remove configuration tasks: Add or remove tasks in the appropriate role's task file
## 🏷️ Using Tags
The playbook now supports tags, allowing you to selectively run or skip specific parts of the configuration. This is useful for:
- Running only specific components during testing
- Updating only certain aspects of your server configuration
- Skipping parts that you've already configured or don't need
### Available Tags
- **system**: System-related tasks
- **updates**: Update-related tasks (both system and automatic updates)
- **logging**: Logging configuration tasks
- **rsyslog**: rsyslog-specific configuration
- **logrotate**: logrotate-specific configuration
- **log_monitoring**: Log monitoring tasks
- **log_directory**: Log directory creation
- **time**: Time configuration tasks
- **ssh**: SSH configuration tasks
- **users**: User management tasks
- **packages**: Package installation tasks
- **security**: Security-related tasks
- **fail2ban**: Fail2ban configuration
- **ufw**: Firewall configuration
- **automatic**: Automatic update configuration
### Using Tags
To run only specific parts of the playbook, use the `--tags` option:
```bash
# Run only security-related tasks
ansible-playbook playbook.yml --tags security
# Run only SSH and user management tasks
ansible-playbook playbook.yml --tags "ssh,users"
# Run only fail2ban configuration
ansible-playbook playbook.yml --tags fail2ban
```
To skip specific parts of the playbook, use the `--skip-tags` option:
```bash
# Run everything except automatic updates
ansible-playbook playbook.yml --skip-tags automatic
# Run everything except security and logging
ansible-playbook playbook.yml --skip-tags "security,logging"
```
You can also combine these approaches for more complex scenarios.
## 🤝 Contributions
Stars and contributions are highly appreciated! If you find this project useful, please consider:
- ⭐ Starring the repository
- 🐛 Opening issues for bugs or feature requests
- 📢 Sharing with fellow sysadmins and DevOps engineers
Let's collaborate to build a more robust, secure, and feature-rich server configuration tool together!
## 📜 License
This project is licensed under the MIT License - see the LICENSE file for details.