自动化加固脚本参考

# linux_security_hardening.yml
- hosts: all
  become: yes
  tasks:
    # SSH 加固
    - name: SSH 安全配置
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: ""
        line: ""
      loop:
        - { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
        - { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
        - { regexp: '^#?MaxAuthTries', line: 'MaxAuthTries 3' }
        - { regexp: '^#?ClientAliveInterval', line: 'ClientAliveInterval 300' }
      notify: restart sshd

    # 禁用不必要服务
    - name: 禁用不必要服务
      systemd:
        name: ""
        enabled: no
        state: stopped
      loop: [telnet, rpcbind, avahi-daemon, cups]
      ignore_errors: yes

    # 内核参数加固
    - name: 内核安全参数
      sysctl:
        name: ""
        value: ""
        state: present
        reload: yes
      loop:
        - { key: 'net.ipv4.ip_forward', value: '0' }
        - { key: 'net.ipv4.conf.all.send_redirects', value: '0' }
        - { key: 'net.ipv4.conf.all.accept_redirects', value: '0' }
        - { key: 'net.ipv4.tcp_syncookies', value: '1' }
        - { key: 'kernel.randomize_va_space', value: '2' }

    # 文件权限加固
    - name: 关键文件权限
      file:
        path: ""
        owner: root
        group: root
        mode: ""
      loop:
        - { path: '/etc/shadow', mode: '0600' }
        - { path: '/etc/gshadow', mode: '0600' }
        - { path: '/etc/passwd', mode: '0644' }
        - { path: '/etc/ssh/sshd_config', mode: '0600' }

    # 密码策略
    - name: 设置密码有效期
      lineinfile:
        path: /etc/login.defs
        regexp: ""
        line: ""
      loop:
        - { regexp: '^PASS_MAX_DAYS', line: 'PASS_MAX_DAYS 90' }
        - { regexp: '^PASS_MIN_DAYS', line: 'PASS_MIN_DAYS 7' }
        - { regexp: '^PASS_MIN_LEN', line: 'PASS_MIN_LEN 12' }

  handlers:
    - name: restart sshd
      systemd:
        name: sshd
        state: restarted