v1.0.0

playbooks/playbook_security_baseline.yml

@@ -0,0 +1,64 @@
+---
+# Baza bezpieczeństwa: unattended-upgrades (tylko aktualizacje bezpieczeństwa,
+# bez automatycznego restartu — patrz playbook_fleet_report.yml dla flagi reboot-required)
+# oraz wyłączenie logowania hasłem po SSH.
+- name: Baza bezpieczeństwa (unattended-upgrades + wyłączenie logowania hasłem)
+  hosts: all
+  gather_facts: true
+
+  tasks:
+    - name: Zainstaluj unattended-upgrades (Debian/Ubuntu)
+      ansible.builtin.apt:
+        name:
+          - unattended-upgrades
+          - apt-listchanges
+        state: present
+        update_cache: yes
+        cache_valid_time: 3600
+      when: ansible_os_family in ["Debian", "Ubuntu"]
+
+    - name: Skonfiguruj unattended-upgrades (tylko aktualizacje bezpieczeństwa, bez auto-reboot)
+      ansible.builtin.template:
+        src: ../templates/50unattended-upgrades.j2
+        dest: /etc/apt/apt.conf.d/50unattended-upgrades
+        owner: root
+        group: root
+        mode: "0644"
+      when: ansible_os_family in ["Debian", "Ubuntu"]
+
+    - name: Włącz okresowe aktualizacje APT (20auto-upgrades)
+      ansible.builtin.copy:
+        dest: /etc/apt/apt.conf.d/20auto-upgrades
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          APT::Periodic::Update-Package-Lists "1";
+          APT::Periodic::Unattended-Upgrade "1";
+      when: ansible_os_family in ["Debian", "Ubuntu"]
+
+    - name: Wyłącz logowanie hasłem (PasswordAuthentication no)
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '(?i)^\s*#?\s*PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+        backup: yes
+        validate: '/usr/sbin/sshd -t -f %s'
+      notify: Restart SSH
+
+    - name: Ogranicz logowanie root do klucza (PermitRootLogin prohibit-password)
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '(?i)^\s*#?\s*PermitRootLogin'
+        line: 'PermitRootLogin prohibit-password'
+        state: present
+        backup: yes
+        validate: '/usr/sbin/sshd -t -f %s'
+      notify: Restart SSH
+
+  handlers:
+    - name: Restart SSH
+      ansible.builtin.service:
+        name: ssh
+        state: restarted