45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
---
|
|
- name: Audit SSH daemon effective configuration
|
|
ansible.builtin.command:
|
|
argv:
|
|
- sshd
|
|
- -T
|
|
register: baseline_sshd_effective
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Report SSH hardening observations without changing SSH
|
|
ansible.builtin.debug:
|
|
msg:
|
|
permit_root_login: >-
|
|
{{ baseline_sshd_effective.stdout_lines | select('match', '^permitrootlogin ') | list }}
|
|
password_authentication: >-
|
|
{{ baseline_sshd_effective.stdout_lines | select('match', '^passwordauthentication ') | list }}
|
|
|
|
- name: Audit time synchronization service state
|
|
ansible.builtin.command:
|
|
argv:
|
|
- systemctl
|
|
- is-active
|
|
- systemd-timesyncd
|
|
register: baseline_timesync_state
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Install baseline logrotate policy only with explicit opt-in
|
|
ansible.builtin.copy:
|
|
dest: /etc/logrotate.d/vps-baseline
|
|
content: |
|
|
/var/log/vps-health/*.log /var/log/vps-restic/*.log {
|
|
weekly
|
|
rotate 8
|
|
missingok
|
|
notifempty
|
|
compress
|
|
create 0640 root root
|
|
}
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: baseline_manage_logrotate | bool
|