150 lines
5.3 KiB
YAML
150 lines
5.3 KiB
YAML
---
|
|
- name: Security Audit - Generate Reports
|
|
hosts: all:!localhost
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Create audit directory
|
|
ansible.builtin.file:
|
|
path: "/tmp/security-audit-{{ inventory_hostname }}"
|
|
state: directory
|
|
mode: '0755'
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Collect SSH configuration
|
|
ansible.builtin.shell: |
|
|
sshd -T 2>/dev/null | grep -E '(permit|password|pubkey|port|authentication)' || echo "Unable to check SSH config"
|
|
register: ssh_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Collect firewall status
|
|
ansible.builtin.shell: |
|
|
if command -v ufw >/dev/null 2>&1; then
|
|
ufw status numbered 2>/dev/null || echo "UFW not active"
|
|
else
|
|
echo "No firewall detected"
|
|
fi
|
|
register: firewall_check
|
|
changed_when: false
|
|
|
|
- name: Collect open ports
|
|
ansible.builtin.shell: ss -tlnp | grep LISTEN
|
|
register: ports_check
|
|
changed_when: false
|
|
|
|
- name: Collect sudo users
|
|
ansible.builtin.shell: getent group sudo 2>/dev/null || getent group wheel 2>/dev/null || echo "No sudo group"
|
|
register: sudo_check
|
|
changed_when: false
|
|
|
|
- name: Collect password authentication users
|
|
ansible.builtin.shell: |
|
|
awk -F: '($2 != "!" && $2 != "*" && $2 != "") {print $1}' /etc/shadow 2>/dev/null | head -20 || echo "Unable to check"
|
|
register: pass_users_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Collect recent failed logins
|
|
ansible.builtin.shell: |
|
|
journalctl -u sshd --no-pager -n 50 2>/dev/null | grep -i "failed\|authentication failure" | tail -10 || echo "No recent failures or unable to check"
|
|
register: failed_logins_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Check automatic updates
|
|
ansible.builtin.shell: |
|
|
if [ -f /etc/apt/apt.conf.d/20auto-upgrades ]; then
|
|
echo "Automatic updates: ENABLED"
|
|
cat /etc/apt/apt.conf.d/20auto-upgrades
|
|
else
|
|
echo "Automatic updates: NOT CONFIGURED"
|
|
fi
|
|
register: auto_updates_check
|
|
changed_when: false
|
|
|
|
- name: Check for available security updates
|
|
ansible.builtin.shell: |
|
|
apt-get update -qq 2>&1 | head -5
|
|
apt list --upgradable 2>/dev/null | grep -i security | wc -l || echo "0"
|
|
register: security_updates_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Generate security report
|
|
ansible.builtin.copy:
|
|
content: |
|
|
╔════════════════════════════════════════════════════════════════╗
|
|
║ Security Audit Report: {{ inventory_hostname }}
|
|
║ IP: {{ ansible_host }}
|
|
║ Date: {{ ansible_date_time.iso8601 }}
|
|
╚════════════════════════════════════════════════════════════════╝
|
|
|
|
=== SYSTEM INFORMATION ===
|
|
OS: {{ ansible_distribution }} {{ ansible_distribution_version }}
|
|
Kernel: {{ ansible_kernel }}
|
|
Architecture: {{ ansible_architecture }}
|
|
|
|
=== SSH CONFIGURATION ===
|
|
{{ ssh_check.stdout }}
|
|
|
|
=== FIREWALL STATUS ===
|
|
{{ firewall_check.stdout }}
|
|
|
|
=== OPEN NETWORK PORTS ===
|
|
{{ ports_check.stdout }}
|
|
|
|
=== SUDO USERS ===
|
|
{{ sudo_check.stdout }}
|
|
|
|
=== USERS WITH PASSWORD AUTH ===
|
|
{{ pass_users_check.stdout }}
|
|
|
|
=== RECENT FAILED LOGIN ATTEMPTS ===
|
|
{{ failed_logins_check.stdout }}
|
|
|
|
=== AUTOMATIC UPDATES ===
|
|
{{ auto_updates_check.stdout }}
|
|
|
|
=== AVAILABLE SECURITY UPDATES ===
|
|
Security updates available: {{ security_updates_check.stdout_lines[-1] | default('Unknown') }}
|
|
|
|
dest: "/tmp/security-audit-{{ inventory_hostname }}/report.txt"
|
|
mode: '0644'
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Generate Summary Report
|
|
hosts: localhost
|
|
gather_facts: false
|
|
|
|
tasks:
|
|
- name: Find all audit reports
|
|
ansible.builtin.find:
|
|
paths: /tmp
|
|
patterns: "security-audit-*/report.txt"
|
|
recurse: true
|
|
register: audit_reports
|
|
|
|
- name: Display report locations
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
╔════════════════════════════════════════════════════════════════╗
|
|
║ Security Audit Complete ║
|
|
╚════════════════════════════════════════════════════════════════╝
|
|
|
|
Reports generated for {{ audit_reports.files | length }} servers
|
|
|
|
View individual reports:
|
|
{% for file in audit_reports.files %}
|
|
- {{ file.path }}
|
|
{% endfor %}
|
|
|
|
View all reports:
|
|
cat /tmp/security-audit-*/report.txt
|
|
|
|
Create consolidated report:
|
|
cat /tmp/security-audit-*/report.txt > /tmp/security-audit-full-report.txt
|