NetguruGist

/etc/apt/apt.conf.d/50unattended-upgrades

NetguruGist

    - name: "Automated security updates"

      apt: name=unattended-upgrades state=present

    - file: path=/etc/apt/apt.conf.d/10periodic state=absent

    - blockinfile:

        dest: /etc/apt/apt.conf.d/10periodic

NetguruGist

    - ufw: rule=allow port=22 from_ip=IP proto=tcp

NetguruGist

    - name: "Setting up a firewall"

      action: lineinfile dest=/etc/default/ufw regexp="^IPV6" line="IPV6=yes" state=present

    - ufw: rule=allow port={% raw %}{{ item }}{% endraw %} proto=tcp

      with_items:

        - 22

NetguruGist

  (...)

  become: true

  handlers:

    - name: Restart ssh

      action: service name=ssh state=restarted

NetguruGist

    - name: "Enforce ssh key logins"

      action: lineinfile dest=/etc/ssh/sshd_config regexp="^PermitRootLogin" line="PermitRootLogin no" state=present

      notify: Restart ssh

    - action: lineinfile dest=/etc/ssh/sshd_config regexp="^PasswordAuthentication" line="PasswordAuthentication no" state=present

      notify: Restart ssh

NetguruGist

apt-get update; apt-get upgrade
apt-get  install pwgen whois
/usr/bin/pwgen -s 40 1 (save result internally to Ansible to “root_password” variable)
/usr/bin/mkpasswd {result from root_password} --method=SHA-512 (save internally to “root_crypted_password”)
Set the root password
Print the root password, so that you can see what it is 

NetguruGist

apt-get update; apt-get upgrade
apt-get  install pwgen whois
/usr/bin/pwgen -s 40 1 (save result internally to Ansible to “root_password” variable)
/usr/bin/mkpasswd {result from root_password} --method=SHA-512 (save internally to “root_crypted_password”)
Set the root password
Print the root password, so that you can see what it is 

NetguruGist

    - name: "Add your user"

      user: name=deploy shell=/bin/bash group=sudo

    - authorized_key: user=deploy key="SSH_KEY" exclusive=yes

    - shell: /usr/bin/pwgen -s 40 1

      register: deploy_password

NetguruGist

    - name: "First things first - install latest patches"

      apt: update_cache=yes upgrade=full

    - name: "First things first - create random root password"

      apt: name={{ item }} state=present

      with_items: