dev-sec/ansible-collection-hardening
Ansible Collection Hardening
This is an Ansible collection that automates security hardening for Linux operating systems, databases, web servers, and SSH services. It provides a declarative, modular architecture that enforces idempotent security configurations, ensuring that each task only applies changes when the current system state deviates from the desired security baseline.
The collection organizes security configurations into reusable Ansible roles, each targeting a specific system component. It includes roles for hardening OpenSSH with key-only authentication and disabled root login, securing MySQL and MariaDB installations with strong authentication and local binding, and configuring Nginx and Apache web servers by disabling server tokens and restricting cipher suites. The roles are designed to work across multiple Linux families, using distribution-specific conditionals and package managers.
The collection maps hardening tasks to established security standards such as CIS benchmarks, grouping controls into role-specific conditional logic. It generates configuration files from Jinja2 templates with variables, enabling customization across different Linux distributions without duplicating code. The final hardened state of a system is defined in YAML inventory variables, allowing Ansible to converge any machine toward that state through continuous application.
Features
- Ansible Collections - An Ansible collection that automates security baselines for Linux systems, network services, and databases to reduce attack surfaces and enforce compliance.
- Linux Security Hardening - Apply security hardening configurations to operating systems to meet compliance baselines, including user account restrictions and permission settings.
- Automated Hardening Playbooks - Playbooks that configure kernel parameters, user accounts, file permissions, and audit settings for Linux distributions.
- Database Server Hardening - Enforce strong database authentication, remove default test databases, bind services to local sockets, and apply compliance baselines to secure database servers.
- MySQL & MariaDB Hardening - Ansible tasks that remove anonymous accounts, set root passwords, bind to localhost, and delete default test databases.
- SSH Service Hardening - Disable remote root login, enforce key-based authentication, restrict encryption ciphers, and apply security baselines to secure shell daemon configuration.
- Web Server Hardening - Hardening web servers like Nginx by disabling server tokens, restricting cipher suites, and limiting attack surface.
- SSH Hardening Playbooks - Ansible roles that enforce key-based authentication, disable root login, and restrict cipher suites on SSH servers.
- SSH Security Configurations - Configuring OpenSSH with key-only authentication, disabled root login, and strong ciphers to secure remote access.
- System State Idempotency - Ensures each Ansible task only applies changes when the current system state deviates from the desired security baseline, preventing repeated modifications.
- Infrastructure State Enforcers - Defines the final hardened state of a system in YAML inventory variables, allowing Ansible to converge any machine toward that state through continuous application.
- Cross-Distribution Role Support - Tests and validates role execution across multiple Linux families (Debian, Red Hat, etc.) using distribution-specific conditionals and package managers.
- Role-Based Configuration Modularization - Organises security configurations into reusable Ansible roles, each targeting a specific system component like SSH, nginx, or MySQL.
- Compliance Baseline Mappings - Aligns hardening tasks with established security standards such as CIS benchmarks by grouping controls into role-specific conditional logic.
- Nginx Security Hardening - Automated configuration to disable server tokens, limit SSL protocols, and set secure headers for Nginx deployments.
