deploy-base/roles/hardening/tasks/main.yml

---

- name: include SELinux package tasks for EL (CentOS/RHEL)
  include_tasks: centos-selinux.yml
  tags: selinux
  when: (ansible_distribution in ["CentOS" , "Red Hat Enterprise Linux", "RedHat"])

- name: include SELinux package tasks for Fedora (non-atomic)
  include_tasks: fedora-selinux.yml
  tags: selinux
  when: (ansible_distribution in ["Fedora"] and not is_atomic)

# likely to break on non-RHEL/derivatives, could use improvement.
- name: ensure firewalld is installed
  become: true
  package:
    name: firewalld
    state: present

- name: enable firewalld
  become: true
  service:
    name: firewalld
    state: started
    enabled: true

- name: harden sshd
  tags: harden_sshd
  become: true
  block:
    - name: "SSH: disable password auth"
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^PasswordAuthentication"
        line: "PasswordAuthentication no"
        validate: '/usr/sbin/sshd -t -f %s'
      notify: restart sshd
    - name: "SSH: config custom port"
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^Port '
        line: "Port {{ hardened_ssh_port }}"
        insertbefore: "(^|#)AddressFamily.*"
        validate: '/usr/sbin/sshd -t -f %s'
      when: (hardened_ssh_port is defined)
      notify: restart sshd
    - name: "only allow root logins with keys"
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin '
        line: 'PermitRootLogin prohibit-password'
        validate: '/usr/sbin/sshd -t -f %s'
      notify: restart sshd
    - name: "disallow keyboard interactive auth to address some PAM edge cases"
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^KbdInteractiveAuthentication '
        line: 'KbdInteractiveAuthentication no'
        validate: '/usr/sbin/sshd -t -f %s'
      notify: restart sshd

- name: "permit custom SSH port ({{ hardened_ssh_port }})"
  become: true
  seport:
    ports: "{{ hardened_ssh_port }}"
    proto: tcp
    setype: ssh_port_t
    state: present
  when:
    - hardened_ssh_port is defined
    - ansible_selinux is defined
    - ansible_selinux.status == 'enabled'
  tags: selinux

# also likely to break on non-RHEL/derivatives, could use improvement too.
- name: "firewalld: grant access to custom SSH port"
  become: true
  firewalld:
    port: "{{ hardened_ssh_port }}/tcp"
    permanent: true
    immediate: true
    state: enabled
  when: (hardened_ssh_port is defined)