rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Browse Source 
Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.
This commit is contained in:
Hermes Agent service account
2026-05-29 20:40:04 -05:00
parent 1dfa7889ab
commit 91b5817e5f
25 changed files with 741 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
ansible/roles/linux-baseline/templates/sshd_hardening.conf.j2 Normal file
View File

@@ -0,0 +1,19 @@
# {{ ansible_managed }}
# mk-labs SSH hardening drop-in
# Managed by Ansible - linux-baseline role
PermitRootLogin {{ baseline_ssh_permit_root_login }}
PasswordAuthentication {{ baseline_ssh_password_authentication }}
PubkeyAuthentication {{ baseline_ssh_pubkey_authentication }}
PermitEmptyPasswords {{ baseline_ssh_permit_empty_passwords }}
X11Forwarding {{ baseline_ssh_x11_forwarding }}
ClientAliveInterval {{ baseline_ssh_client_alive_interval }}
ClientAliveCountMax {{ baseline_ssh_client_alive_count_max }}
MaxAuthTries {{ baseline_ssh_max_auth_tries }}
LoginGraceTime {{ baseline_ssh_login_grace_time }}
# Prefer modern key exchange and ciphers
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com