awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
dev-sec avatar

dev-sec/ansible-os-hardening

0
View on GitHub↗
5,391 stars·827 forks·Jinja·Apache-2.0·23 viewsdev-sec.io↗

Ansible Os Hardening

This project is a collection of automated hardening frameworks and Ansible roles designed to secure Linux systems, databases, SSH services, and web servers. It functions as a configuration framework that reduces the attack surface of Linux distributions through the automated enforcement of security policies.

The collection provides specific security baselines for a variety of services, including MySQL databases, OpenSSH daemons, and web servers such as Nginx and Apache. These roles are designed to remove insecure defaults, enforce secure authentication methods, and align system configurations with established industry standards.

The framework utilizes a variable-driven configuration model and declarative mapping to ensure that security settings remain consistent across different server roles. Its capabilities cover the broad domains of operating system security, remote access control, and database protection.

Features

  • Ansible Playbooks - Provides declarative Ansible playbooks for automating the deployment of hardened security configurations.
  • Secure Database Configurations - Applies restrictive configuration sets to MySQL database instances to protect stored data.
  • Ansible Modules - Utilizes a collection of Ansible modules to execute OS-level security changes across Linux distributions.
  • Linux Security Hardening - Provides configuration settings and security modules to harden the Linux operating system against exploitation.
  • MySQL & MariaDB Hardening - Secures MySQL and MariaDB databases by removing anonymous accounts and restricting system access.
  • SSH Service Hardening - Implements Ansible roles that disable root login and enforce key-based authentication for SSH daemons.
  • Web Server Hardening - Provides security directives for hardening Nginx and Apache web server software.
  • System State Idempotency - Ensures system-level configurations match a desired security baseline without redundant operations.
  • System Security Hardening - Utilizes utilities for configuring and securing operating system settings to align with security standards.
  • Configuration Variable Overrides - Allows overriding default security parameters via external YAML variable files.
  • Compliance Baseline Mappings - Maps security hardening tasks to compliance frameworks like CIS benchmarks using role-specific logic.
  • Role-Based Server Targeting - Uses role-based server targeting to apply specific security baselines to database or web servers.
  • Security Baselines - Establishes minimum essential security baselines for Nginx and Apache web servers.
  • Apache Hardening - Provides automated security baselines and configuration hardening for Apache web servers.
  • Nginx Security Hardening - Provides automated security configurations for Nginx, including SSL protocol limits and secure HTTP headers.
  • DevOps Security - Ansible role for automated operating system hardening.

Star history

Star history chart for dev-sec/ansible-os-hardeningStar history chart for dev-sec/ansible-os-hardening

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Projects sharing features with Ansible Os Hardening

These projects share indexed features with Ansible Os Hardening. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • dev-sec/ansible-collection-hardeningdev-sec avatar

    dev-sec/ansible-collection-hardening

    5,225View on GitHub↗

    This is an Ansible collection that automates security hardening for Linux operating systems, databases, web servers, and SSH services. It provides a declarative, modular architecture that enforces idempotent security configurations, ensuring that each task only applies changes when the current system state deviates from the desired security baseline. The collection organizes security configurations into reusable Ansible roles, each targeting a specific system component. It includes roles for hardening OpenSSH with key-only authentication and disabled root login, securing MySQL and MariaDB ins

    Jinjaansibleansible-collectioncollection
    View on GitHub↗5,225
  • geerlingguy/mac-dev-playbookgeerlingguy avatar

    geerlingguy/mac-dev-playbook

    6,985View on GitHub↗

    This project is an Ansible-based automation suite designed to provision macOS development environments. It utilizes a set of playbooks to automate the installation of software, the configuration of system settings, and the setup of tools required for software engineering. The system distinguishes itself through variable-driven configuration and symlink-based dotfile syncing, allowing users to override default package lists and synchronize preferences from a central store. It supports both local setup and remote machine provisioning via SSH. The automation surface covers idempotent state mana

    Shell
    View on GitHub↗6,985
  • kubernetes-sigs/kubespraykubernetes-sigs avatar

    kubernetes-sigs/kubespray

    18,576View on GitHub↗

    Kubespray is an Ansible-based tool for deploying production-ready Kubernetes clusters on physical or virtual machines across various environments. It serves as an infrastructure provisioner and cluster deployer that automates the installation and configuration of cluster nodes. The project functions as a bare metal cluster orchestrator, allowing for the setup of Kubernetes on physical hardware without relying on a managed cloud provider. It includes specialized installers for configuring networking fabrics, pod communication plugins, and routing policies. The framework also manages the insta

    Jinjaansibleawsbare-metal
    View on GitHub↗18,576
  • vonng/pigstyVonng avatar

    Vonng/pigsty

    5,172View on GitHub↗

    Pigsty is a comprehensive database infrastructure orchestration platform designed to automate the full lifecycle of high-availability PostgreSQL clusters. It functions as an infrastructure-as-code framework that manages cluster coordination, node provisioning, and service discovery through idempotent playbooks. By integrating distributed consensus mechanisms, the platform ensures automated failover and consistent state enforcement across diverse environments, including bare metal and virtualized infrastructure. The platform distinguishes itself through a robust suite of operational capabiliti

    Shell
    View on GitHub↗5,172
Compare all 30 related projects→

Frequently asked questions

What does dev-sec/ansible-os-hardening do?

This project is a collection of automated hardening frameworks and Ansible roles designed to secure Linux systems, databases, SSH services, and web servers. It functions as a configuration framework that reduces the attack surface of Linux distributions through the automated enforcement of security policies.

What are the main features of dev-sec/ansible-os-hardening?

The main features of dev-sec/ansible-os-hardening are: Ansible Playbooks, Secure Database Configurations, Ansible Modules, Linux Security Hardening, MySQL & MariaDB Hardening, SSH Service Hardening, Web Server Hardening, System State Idempotency.

Which projects share features with dev-sec/ansible-os-hardening?

Projects with overlapping indexed features include: dev-sec/ansible-collection-hardening — This is an Ansible collection that automates security hardening for Linux operating systems, databases, web servers,… geerlingguy/mac-dev-playbook — This project is an Ansible-based automation suite designed to provision macOS development environments. It utilizes a… kubernetes-sigs/kubespray — Kubespray is an Ansible-based tool for deploying production-ready Kubernetes clusters on physical or virtual machines… vonng/pigsty — Pigsty is a comprehensive database infrastructure orchestration platform designed to automate the full lifecycle of… owasp/top10 — This project is a web application security standard and vulnerability framework. It provides a comprehensive list of… artemmkin/infrastructure-as-code-tutorial — This project serves as an educational resource for mastering automated infrastructure provisioning, configuration…