61 lines
1.5 KiB
YAML
Executable File
61 lines
1.5 KiB
YAML
Executable File
---
|
|
# restrict-ssh.yml
|
|
#
|
|
# Restricts SSH access on Ubuntu servers to a single IP range using UFW.
|
|
# Uses the community.general.ufw module.
|
|
#
|
|
# Usage:
|
|
# ansible-playbook -i inventory.ini restrict-ssh.yml
|
|
#
|
|
# Override the range or port at runtime:
|
|
# ansible-playbook -i inventory.ini restrict-ssh.yml -e "ssh_allowed_range=10.0.0.0/24 ssh_port=2222"
|
|
|
|
- name: Restrict SSH access to an allowed IP range
|
|
hosts: ubuntu_servers
|
|
become: true
|
|
|
|
vars:
|
|
ssh_allowed_range: "192.168.1.0/24"
|
|
ssh_port: 22
|
|
|
|
tasks:
|
|
- name: Ensure UFW is installed
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Set default policy to deny incoming traffic
|
|
community.general.ufw:
|
|
direction: incoming
|
|
policy: deny
|
|
|
|
- name: Set default policy to allow outgoing traffic
|
|
community.general.ufw:
|
|
direction: outgoing
|
|
policy: allow
|
|
|
|
- name: Allow SSH only from the permitted range
|
|
community.general.ufw:
|
|
rule: allow
|
|
from_ip: "{{ ssh_allowed_range }}"
|
|
to_port: "{{ ssh_port }}"
|
|
proto: tcp
|
|
|
|
- name: Remove any rule allowing SSH from anywhere (by port)
|
|
community.general.ufw:
|
|
rule: allow
|
|
to_port: "{{ ssh_port }}"
|
|
proto: tcp
|
|
delete: true
|
|
|
|
- name: Remove any rule allowing the OpenSSH application profile from anywhere
|
|
community.general.ufw:
|
|
rule: allow
|
|
name: OpenSSH
|
|
delete: true
|
|
|
|
- name: Enable UFW
|
|
community.general.ufw:
|
|
state: enabled
|