Security Automation with Ansible 2

Hardening SSH service

This will be like a more traditional approach, with a modern automated method, using Ansible. Some of the items included here are:

• Disabling the root user login, and instead creating a different user, and, if required, providing the sudo privilege:

    - name: create new user      user:        name: "{{ new_user_name }}"        password: "{{ new_user_password }}"

        shell: /bin/bash        groups: sudo        append: yes

• Using key-based authentication to log in. Unlike with password-based authentication, we can generate SSH keys and add the public key to the authorized keys:

    - name: add ssh key for new user      authorized_key:        user: "{{ new_user_name }}"        key: "{{ lookup('file', '/home/user/.ssh/id_rsa.pub') }}"        state: present

• Some of the configuration ...