ansible

ansible/roles/ssh_hardening/tasks/main.yaml

@@ -0,0 +1,80 @@
+---
+- name: Install iptables and iptables-persistent
+  ansible.builtin.apt:
+    name:
+      - iptables
+      - iptables-persistent
+      - netfilter-persistent
+    state: present
+    update_cache: true
+
+- name: Deploy SSH hardening configuration
+  ansible.builtin.template:
+    src: 99-ssh-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/99-ssh-hardening.conf
+    mode: '0644'
+    owner: root
+    group: root
+    validate: 'sshd -t -f %s'
+  notify: restart sshd
+
+- name: Configure iptables for SSH restrictions (non-Forgejo servers)
+  block:
+    - name: Accept SSH from WireGuard network
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        source: 10.20.0.0/24
+        jump: ACCEPT
+        comment: Allow SSH from WireGuard VPN
+
+    - name: Accept SSH from VPC network
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        source: 10.10.0.0/20
+        jump: ACCEPT
+        comment: Allow SSH from internal VPC
+
+    - name: Accept established SSH connections
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        ctstate: ESTABLISHED,RELATED
+        jump: ACCEPT
+        comment: Allow established SSH connections
+
+    - name: Drop all other SSH connections
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        jump: DROP
+        comment: Drop SSH from untrusted networks
+
+  when: not ssh_allow_public_git
+
+- name: Save iptables rules
+  ansible.builtin.shell: |
+    iptables-save > /etc/iptables/rules.v4
+    netfilter-persistent save
+  args:
+    executable: /bin/bash
+  changed_when: true
+  when: not ssh_allow_public_git
+
+- name: Display SSH access information
+  ansible.builtin.debug:
+    msg: |
+      SSH hardening applied to {{ inventory_hostname }}:
+      - Shell users ({{ ssh_shell_users | join(', ') }}): Only from {{ ssh_allowed_networks | join(', ') }}
+      {% if ssh_allow_public_git %}
+      - Git user ({{ ssh_git_user }}): Public access allowed for Forgejo
+      - No iptables restrictions (sshd AllowUsers controls access)
+      {% else %}
+      - iptables rules: SSH blocked except from trusted networks
+      {% endif %}
+      - Strong cryptography enforced (RSA-SHA2, Ed25519, ChaCha20, AES-GCM)