65 lines
2.1 KiB
YAML
65 lines
2.1 KiB
YAML
---
|
|
# Baza bezpieczeństwa: unattended-upgrades (tylko aktualizacje bezpieczeństwa,
|
|
# bez automatycznego restartu — patrz playbook_fleet_report.yml dla flagi reboot-required)
|
|
# oraz wyłączenie logowania hasłem po SSH.
|
|
- name: Baza bezpieczeństwa (unattended-upgrades + wyłączenie logowania hasłem)
|
|
hosts: all
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Zainstaluj unattended-upgrades (Debian/Ubuntu)
|
|
ansible.builtin.apt:
|
|
name:
|
|
- unattended-upgrades
|
|
- apt-listchanges
|
|
state: present
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
when: ansible_os_family in ["Debian", "Ubuntu"]
|
|
|
|
- name: Skonfiguruj unattended-upgrades (tylko aktualizacje bezpieczeństwa, bez auto-reboot)
|
|
ansible.builtin.template:
|
|
src: ../templates/50unattended-upgrades.j2
|
|
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: ansible_os_family in ["Debian", "Ubuntu"]
|
|
|
|
- name: Włącz okresowe aktualizacje APT (20auto-upgrades)
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
when: ansible_os_family in ["Debian", "Ubuntu"]
|
|
|
|
- name: Wyłącz logowanie hasłem (PasswordAuthentication no)
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '(?i)^\s*#?\s*PasswordAuthentication'
|
|
line: 'PasswordAuthentication no'
|
|
state: present
|
|
backup: yes
|
|
validate: '/usr/sbin/sshd -t -f %s'
|
|
notify: Restart SSH
|
|
|
|
- name: Ogranicz logowanie root do klucza (PermitRootLogin prohibit-password)
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '(?i)^\s*#?\s*PermitRootLogin'
|
|
line: 'PermitRootLogin prohibit-password'
|
|
state: present
|
|
backup: yes
|
|
validate: '/usr/sbin/sshd -t -f %s'
|
|
notify: Restart SSH
|
|
|
|
handlers:
|
|
- name: Restart SSH
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: restarted
|