Add banner

README.md

@@ -77,6 +77,7 @@ Inventory variables are defined for individual hosts or VMs in the inventory fil
 | `root_password`         | Root password for the VM or system, used for initial setup or secure access.      | `SecurePass123`                                    |
 | `user_name`             | Username for a user account within the VM, often used with cloud-init.            | `adminuser`                                        |
 | `user_password`         | Password for the user account within the VM.                                      | `UserPass123`                                      |
+| `user_public_key`       | SSH Key for the user account within the VM.                                       | `ssh-ed25519 AAAAC`                                |
 | `vm_ballo` (optional)   | Ballooning memory size for the VM, used to adjust memory allocation dynamically.  | `2048`                                             |
 | `vm_cpus`               | Number of CPU cores assigned to the virtual machine.                              | `4`                                                |
 | `vm_dns`                | DNS server IP address(es) for the virtual machine's network configuration.        | `1.0.0.1`, `1.1.1.1`                               |

main.yml

@@ -10,6 +10,11 @@
         What is your username?
       private: false
     
+    - name: user_public_key
+      prompt: |
+        What is your ssh key?
+      private: false
+
     - name: user_password
       prompt: |
         What is your password?
@@ -81,7 +86,7 @@
 
   tasks:
     - name: Set final SSH Credentials
-      when: hypervisor == 'vmware' and vmware_ssh | bool
+      when: hypervisor != 'vmware' or (hypervisor == 'vmware' and vmware_ssh | bool)
       ansible.builtin.set_fact:
         ansible_user: "{{ user_name }}"
         ansible_password: "{{ user_password }}"
@@ -91,3 +96,4 @@
     - name: Check if VM is back and running
       ansible.builtin.wait_for_connection:
         timeout: 300
+        

roles/bootstrap/vars/packages.yml

@@ -16,7 +16,6 @@ almalinux:
   - open-vm-tools
   - ppp
   - shim
-  - telnet
   - tmux
   - vim
   - wget
@@ -188,7 +187,6 @@ fedora:
   - ppp
   - ripgrep
   - shim
-  - telnet
   - tmux
   - vim-default-editor
   - wget
@@ -200,6 +198,8 @@ rhel8:
   - bind-utils
   - dhcp-client
   - efibootmgr
+  - glibc-langpack-de
+  - glibc-langpack-en
   - grub2
   - grub2-efi-x64
   - lrzsz
@@ -209,7 +209,6 @@ rhel8:
   - open-vm-tools
   - python
   - shim
-  - telnet
   - tmux
   - vim
   - zstd
@@ -218,6 +217,8 @@ rhel9:
   - bind-utils
   - dhcp-client
   - efibootmgr
+  - glibc-langpack-de
+  - glibc-langpack-en
   - grub2
   - grub2-efi
   - lrzsz
@@ -227,7 +228,6 @@ rhel9:
   - open-vm-tools
   - python
   - shim
-  - telnet
   - tmux
   - vim
   - zram-generator

roles/cis/tasks/main.yml

@@ -7,18 +7,19 @@
         mode: '0644'
         content: |
           CIS LVL 3 Restrictions
-          install freevxfs        /bin/true
+          install freevxfs        /bin/false
-          install jffs2           /bin/true
+          install jffs2           /bin/false
-          install hfs             /bin/true
+          install hfs             /bin/false
-          install hfsplus         /bin/true
+          install hfsplus         /bin/false
-          install squashfs        /bin/true
+          install cramfs          /bin/false
-          install udf             /bin/true
+          install squashfs        /bin/false
-          install usb-storage     /bin/true
+          install udf             /bin/false
+          install usb-storage     /bin/false
 
-          install dccp            /bin/true
+          install dccp            /bin/false
-          install sctp            /bin/true
+          install sctp            /bin/false
-          install rds             /bin/true
+          install rds             /bin/false
-          install tipc            /bin/true
+          install tipc            /bin/false
 
     - name: Create USB Rules
       ansible.builtin.copy:
@@ -43,11 +44,20 @@
         mode: '0644'
         content: |
           ## CIS Sysctl configurations
+          kernel.yama.ptrace_scope=1
+          kernel.randomize_va_space=2
+
+          # Network
+          net.ipv4.ip_forward=0
+          net.ipv4.tcp_syncookies=1
+          net.ipv4.icmp_echo_ignore_broadcasts=1
+          net.ipv4.icmp_ignore_bogus_error_responses=1
           net.ipv4.conf.all.log_martians = 1
           net.ipv4.conf.all.rp_filter = 1
           net.ipv4.conf.all.secure_redirects = 0
           net.ipv4.conf.all.send_redirects = 0
           net.ipv4.conf.all.accept_redirects = 0
+          net.ipv4.conf.all.accept_source_route=0
           net.ipv4.conf.default.log_martians = 1
           net.ipv4.conf.default.rp_filter = 1
           net.ipv4.conf.default.secure_redirects = 0
@@ -59,6 +69,7 @@
           net.ipv6.conf.default.disable_ipv6 = 1
           net.ipv6.conf.lo.disable_ipv6 = 1
 
+
     # - name: Adjust login.defs
     #   replace:
     #     path: /mnt/etc/login.defs
@@ -69,6 +80,31 @@
     #     - { regexp: '^PASS_MIN_DAYS.*', replace: 'PASS_MIN_DAYS 7' }
     #     - { regexp: '^UMASK.*', replace: 'UMASK           027' }
 
+    - name: Ensure the Default UMASK is Set Correctly
+      ansible.builtin.lineinfile:
+        path: "/mnt/etc/profile"
+        regexp: "^(\\s*)umask\\s+\\d+"
+        line: "umask 027"
+
+    - name: Prevent Login to Accounts With Empty Password
+      ansible.builtin.replace:
+        dest: "{{ item }}"
+        regexp: "nullok"
+      loop:
+        - /mnt/etc/pam.d/system-auth
+        - /mnt/etc/pam.d/password-auth
+
+    - name: Configure System Cryptography Policy
+      when: os in ["almalinux", "fedora", "rhel8", "rhel9", "rocky"]
+      ansible.builtin.command:
+        arch-chroot /mnt /usr/bin/update-crypto-policies --set DEFAULT:NO-SHA1
+
+    - name: Mask Systemd Services
+      ansible.builtin.command: >
+        arch-chroot /mnt systemctl mask nftables bluetooth rpcbind
+      changed_when: result.rc == 0
+      register: result
+
     - name: Ensure files exist
       ansible.builtin.file:
         path: "{{ item }}"
@@ -80,6 +116,15 @@
         - /mnt/etc/hosts.allow
         - /mnt/etc/hosts.deny
 
+    - name: Ensure files do not exist
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: touch
+        mode: "0600"
+      loop:
+        - /mnt/etc/at.deny
+        - /mnt/etc/cron.deny
+
     - name: Add Security related lines into config files
       ansible.builtin.lineinfile:
         path: "{{ item.path }}"
@@ -155,7 +200,7 @@
         - { option: X11Forwarding, value: "no" }
         - { option: PermitUserEnvironment, value: "no" }
         - { option: ClientAliveInterval, value: "300" }
-        - { option: ClientAliveCountMax, value: "0" }
+        - { option: ClientAliveCountMax, value: "1" }
         - { option: PermitTunnel, value: "no" }
         - { option: Banner, value: /etc/issue.net }
 
@@ -169,9 +214,9 @@
 
           ### Ciphers and keying ###
           RekeyLimit 512M 6h
-          KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+          KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
           Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
-          MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+          MACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com
           ###########################
 
           AllowStreamLocalForwarding no

roles/configuration/tasks/main.yml

@@ -39,7 +39,7 @@
         - "# TempFS"
         - tmpfs           /tmp            tmpfs           defaults,nosuid,nodev,noexec    0 0
         - tmpfs           /var/tmp        tmpfs           defaults,nosuid,nodev,noexec    0 0
-        - tmpfs           /dev/shm        tmpfs           defaults,noexec    0 0
+        - tmpfs           /dev/shm        tmpfs           defaults,nosuid,nodev,noexec    0 0
 
     - name: Set local timezone
       ansible.builtin.command: "{{ item }}"
@@ -213,19 +213,28 @@
               fs-type = swap
             mode: '0644'
 
-        - name: Copy FirstRun Script
-          when: os | lower != "archlinux"
-          ansible.builtin.template:
-            src: firstrun.sh.j2
-            dest: /mnt/root/firstrun.sh
-            mode: "0755"
-
         - name: Copy Custom Shell config
           ansible.builtin.template:
             src: custom.sh.j2
             dest: /mnt/etc/profile.d/custom.sh
             mode: '0644'
 
+        - name: Create login banner
+          ansible.builtin.copy:
+            dest: "{{ item }}"
+            content: |
+              **************************************************************
+              * WARNING: Unauthorized access to this system is prohibited. *
+              * All activities are monitored and logged.                   *
+              * Disconnect immediately if you are not an authorized user.  *
+              **************************************************************
+            owner: root
+            group: root
+            mode: '0644'
+          loop:
+            - /etc/issue
+            - /etc/issue.net
+
     - name: Setup Network
       block:
         - name: Generate UUID for Network Profile