first commit

2026-07-22 21:01:19 +02:00
commit 8bb06f3737
57 changed files with 3529 additions and 0 deletions
@@ -0,0 +1,76 @@
+- name: SSH HARDENNING
+  hosts: load-balancer
+  become: true
+  gather_facts: true
+  tasks:
+      - name: Créer le groupe ssh
+        ansible.builtin.group:
+            name: ssh
+            state: present
+
+      - ansible.builtin.user:
+            name: "{{ user_ssh }}"
+            shell: /bin/bash
+            groups:
+                - sudo
+                - ssh
+            append: true
+            state: present
+            password: "{{ password_user_ssh }}"
+            update_password: on_create
+            create_home: true
+            home: /home/omnex
+        no_log: true
+
+      - name: Check si la paire de clé SSH existe
+        ansible.builtin.stat:
+            path: "{{ playbook_dir }}/../../.ssh/{{ user_ssh }}"
+        delegate_to: localhost
+        become: false
+        register: ssh_key_check
+        tags: [key]
+
+      - name: Générer la paire de clés SSH localement
+        community.crypto.openssh_keypair:
+            path: "{{ playbook_dir }}/../../.ssh/{{ user_ssh }}"
+            type: ed25519
+        delegate_to: localhost
+        become: false
+        when: not ssh_key_check.stat.exists
+        run_once: true
+        tags: [key]
+
+      - ansible.posix.authorized_key:
+          user: "{{ user_ssh }}"
+          state: present
+          key: "{{ lookup('file', playbook_dir + '/../../.ssh/' + user_ssh + '.pub') }}"
+
+      - name: Déployer la config sshd durcie
+        ansible.builtin.template:
+            src: ../templates/ssh_harden_conf.j2
+            dest: /etc/ssh/sshd_config
+            mode: "0644"
+            owner: root
+            group: root
+            validate: /usr/sbin/sshd -t -f %s
+        notify: restart ssh
+
+      - name: Delete cloud ssh config if exists
+        ansible.builtin.file:
+            path: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
+            state: absent
+
+      - name: Déployer la config cloud-init durcie
+        ansible.builtin.template:
+            src: ../templates/cloud_harden.conf.j2
+            dest: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
+            mode: "0644"
+            owner: root
+            group: root
+        notify: restart ssh
+
+  handlers:
+      - name: restart ssh
+        ansible.builtin.service:
+            name: ssh
+            state: restarted