ansible-playbook批量加固Linux主机安全基线

批量执行Linux主机安全基线加固

随着业务OS数量的剧增，原有的手动安全加固方式效率低，准确性差。基于上述问题，编制了基于ansible playbook的自动化批量加固方法。文中的安全加固项较少，只是提供一个思路，大家根据自己的需求，自行完善加固项即可。

1. 环境

Ansible Version: 2.7.9
Client Host: Centos 6.x/7.x RedHat 6.x/7.x

2. 安全基线加固项

编号	分类	安全加固项
001	配置	设置系统超时时间为300秒
002	配置	修改默认的umask为027
003	用户	禁止root用户SSH登录操作系统
004	用户	禁止除wheel组之外的其他用户切换至root用户
005	用户	创建一个属于wheel组的普通用户，用作OS管理
006	账户	修改密码最长使用周期90天
007	账户	修改密码最短长度为8位
008	账户	密码复杂度配置，至少包含数字，字母，特殊符号3种字符类型
009	日志	配置rsyslog服务器
010	日志	配置syslog服务器
011	服务	重启rsyslog及sshd服务，使配置文件生效

3. ansible-playbook的设计

本文采取总分的设计模式，先设计一个总的playbook，在playbook中，OS版本作为判断条件，不同的OS版本调用不同的tasks，最终实现多版本操作系统的基线加固。实验环境目录结构如下：

/security
	- os_reinforce.yml
	- task/
		- RedHat6.yml
		- RedHat7.yml

#1. 总的playbookos_reinforce.yml
---
- name: Server System Reinforcement
  hosts: all 
  tasks:
    - name: RedHat6 Server System Reinforcement
      import_tasks: tasks/RedHat6.yml
      when: (ansible_facts['distribution'] == "CentOS" and ansible_facts['distribution_major_version'] == "6") or 
            (ansible_facts['distribution'] == "RedHat" and ansible_facts['distribution_major_version'] == "6")

    - name: RedHat7 Server System Reinforcement 
      import_tasks: tasks/RedHat7.yml
      when: (ansible_facts['distribution'] == "CentOS" and ansible_facts['distribution_major_version'] == "7") or
            (ansible_facts['distribution'] == "RedHat" and ansible_facts['distribution_major_version'] == "7")

#2. RedHat6.x系列版本的安全加固脚本RedHat6.yml
---
  - name: create system admin user
    user:
      name: ICNOC
      uid: 1099
      groups: wheel
      password: syAphDStxyaxU

  - name: session timeout
    lineinfile:
      path: /etc/profile
      regexp: '^export TMOUT=600'
      line: export TMOUT=300

  - name: generate syslogfile
    copy:
      content: "*.* @10.142.82.187:514\n"
      dest: /etc/syslog.conf

  - name: append content into rsyslogfile
    lineinfile:
      path: /etc/rsyslog.conf 
      line: '*.* @10.142.82.187:514'

  - name: set PermitRootLogin no
    lineinfile:
      path: /etc/ssh/sshd_config
      regexp: '^#PermitRootLogin yes'
      line: PermitRootLogin no

  - name: set PASS_MAX_DAYS 90
    lineinfile:
      path: /etc/login.defs
      regexp: '^PASS_MAX_DAYS'
      line: PASS_MAX_DAYS   90

  - name: set PASS_MIN_LEN 5
    lineinfile:
      path: /etc/login.defs
      regexp: '^PASS_MIN_LEN'
      line: PASS_MIN_LEN    8

  - name: set PASS minlen minclass
    lineinfile:
      path: /etc/pam.d/system-auth
      regexp: "pam_cracklib.so"
      line: "password    requisite     pam_cracklib.so try_first_pass retry=5 type=  minlen=8 minclass=3"

  - name: set su permission
    lineinfile:
      path: /etc/pam.d/su
      insertafter: "pam_rootok.so"
      line: "auth            required        pam_wheel.so     group=wheel"

  - name: set umask 
    lineinfile:
      path: /etc/profile
      regexp: '002'
      line: "    umask 027"

  - name: restart services
    service: name={{ item }}  state=restarted
    with_items:
      - sshd
      - rsyslog

#3. RedHat7.x系列版本的安全加固方法RedHat7.yml
---
  - name: create system admin user
    user:
      name: ICNOC
      uid: 1099
      groups: wheel
      password: syAphDStxyaxU

  - name: session timeout
    lineinfile:
      path: /etc/profile
      regexp: '^export TMOUT=600'
      line: export TMOUT=300

  - name: generate syslogfile
    copy:
      content: "*.* @10.142.82.187:514\n"
      dest: /etc/syslog.conf

  - name: append content into rsyslogfile
    lineinfile:
      path: /etc/rsyslog.conf 
      line: '*.* @10.142.82.187:514'

  - name: set PermitRootLogin no
    lineinfile:
      path: /etc/ssh/sshd_config
      regexp: '^#PermitRootLogin yes'
      line: PermitRootLogin no

  - name: set PASS_MAX_DAYS 90
    lineinfile:
      path: /etc/login.defs
      regexp: '^PASS_MAX_DAYS'
      line: PASS_MAX_DAYS   90

  - name: set PASS_MIN_LEN 5
    lineinfile:
      path: /etc/login.defs
      regexp: '^PASS_MIN_LEN'
      line: PASS_MIN_LEN    8

  - name: set PASS minlen minclass
    lineinfile:
      path: /etc/pam.d/system-auth
      insertbefore: "pam_pwquality.so"
      line: "password    requisite     pam_cracklib.so try_first_pass retry=5 type=  minlen=8 minclass=3"

  - name: set su permission
    lineinfile:
      path: /etc/pam.d/su
      insertafter: "pam_rootok.so"
      line: "auth            required        pam_wheel.so     group=wheel"

  - name: set umask 
    lineinfile:
      path: /etc/profile
      regexp: '002'
      line: "    umask 027"

  - name: restart services
    service: name={{ item }}  state=restarted
    with_items:
      - sshd
      - rsyslog

4. 执行playbook

# cd /security
# ansible-playbook -v os_reinforce.yml