Ubuntu Server Hardening Ansible

Overview

This Ansible playbook provides a comprehensive security hardening setup for Ubuntu/Debian servers. It's designed to work on bare-metal, VPS.

The playbook is fully idempotent and can be run multiple times safely.

Security Features

This playbook configures:

• System Updates: Automatic security updates (Ubuntu/Debian only)
• SSH Hardening:
  • Disable password authentication
  • Disable root login
  • Configure secure ciphers and MACs
  • Important: Add your SSH keys before running to avoid lockout
• Firewall (UFW):
  • Only allows ports: 22 (SSH), 80 (HTTP), 443 (HTTPS)
  • Default deny policy for all other traffic
• Fail2ban:
  • SSH brute-force protection
  • Optional reporting to AbuseIPDB
• IP Blacklisting:
  • Automatic blocking of known malicious IPs
  • Configurable blacklist level (1-8, default: 3)
  • Based on stamparm/ipsum

Prerequisites

• Ansible installed on your control machine
• Ubuntu/Debian target server(s)
• Root or sudo access to target server(s)
• SSH key pair for authentication

Configuration

Adjust host-specific settings in inventory.ini:

[harden_servers]
server1 ansible_host=YOUR_SERVER_IP ansible_user=root

[harden_servers:vars]
# IP blacklist level (1-8, higher = more restrictive)
firewall_level=3
# Report banned IPs to AbuseIPDB
report_to_abuseipdb=false
abuseipdb_apikey=

Configuration Options

• firewall_level: IP blacklist severity (1-8)
  • 1-3: Moderate (recommended for most servers)
  • 4-6: Strict (may block some legitimate traffic)
  • 7-8: Very strict (only for high-security environments)
• report_to_abuseipdb: Enable/disable reporting to AbuseIPDB
• abuseipdb_apikey: Your API key from AbuseIPDB (if reporting enabled)

Usage

git clone https://github.com/eznix86/hardern-server-ansible.git

cd hardern-server-ansible

# Copy and edit inventory
cp inventory.ini.example inventory.ini
# Edit inventory.ini with your server details

# Run the playbook
ansible-playbook -i inventory.ini harden.yaml

Post-Installation

Verify Firewall Status

# Check UFW status
sudo ufw status verbose

# Should show:
# - 22/tcp (SSH)
# - 80/tcp (HTTP)
# - 443/tcp (HTTPS)

Monitor Fail2ban

# Check SSH jail status
sudo fail2ban-client status sshd

# View banned IPs
sudo fail2ban-client get sshd banip

Check IP Blacklist

# View blocked IP sets
sudo ipset list

SSH Configuration

After running the playbook, verify SSH access works with your keys before closing your current session:

# Test SSH connection in a new terminal
ssh -i ~/.ssh/your_key user@your_server

Troubleshooting

SSH Access Issues

If you get locked out:

1. Use your hosting provider's console/recovery mode
2. Edit /etc/ssh/sshd_config to temporarily enable password auth
3. Add your SSH public key to ~/.ssh/authorized_keys
4. Re-run the playbook

Firewall Blocking Legitimate Traffic

If you need additional ports:

Edit roles/firewall/tasks/main.yml and add:

- name: Allow custom port
  ufw:
    rule: allow
    port: YOUR_PORT
    proto: tcp  # or udp
  notify: reload ufw

View Logs

# SSH authentication logs
sudo journalctl -u ssh

# Fail2ban logs
sudo journalctl -u fail2ban

# UFW logs
sudo tail -f /var/log/ufw.log

Customization

Adding Custom Roles

The playbook structure supports additional roles:

# harden.yaml
roles:
  - common
  - ssh-hardening
  - firewall
  - fail2ban
  - your-custom-role

Adjusting Security Level

Modify individual role tasks in roles/*/tasks/main.yml to adjust:

• SSH hardening parameters
• Firewall rules
• Fail2ban configuration
• IP blacklist aggressiveness

Contributing

Contributions are welcome! Please feel free to submit pull requests or open issues for bugs and feature requests.

License

LICENSE