Skip to content

Commit 4e7be42

Browse files
D3OneD3One
authored
Add files via upload
1 parent 3f6c521 commit 4e7be42

3 files changed

Lines changed: 221 additions & 0 deletions

File tree

‎Ansible samples/README.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# Ansible DevSecOps Playbooks
2+
3+
This repository contains example Ansible playbooks designed to automate security tasks within a DevSecOps pipeline. These playbooks demonstrate how to integrate security checks and hardening procedures into your infrastructure automation process.
4+
5+
<p align="center">
6+
<img src="https://github.com/user-attachments/assets/a5169df1-bb06-42e2-9623-9ce33df20d75" alt="Sublime's custom image"/>
7+
</p>
8+
9+
## What is an Ansible Playbook?
10+
11+
An Ansible Playbook is a YAML file that defines a set of automation tasks, configurations, and policies to be enforced on remote hosts. It allows you to describe your desired state for infrastructure and applications in a code-like manner, making it versionable, repeatable, and idempotent (meaning you can run it multiple times without causing unintended changes).
12+
13+
## Playbooks Overview
14+
15+
### 1. Host Hardening Playbook (`host-hardening.yml`)
16+
17+
This playbook performs basic security hardening on a Linux server by:
18+
- Disabling SSH root login.
19+
- Restricting SSH access to specific users.
20+
- Disabling weak SSH encryption algorithms.
21+
- Installing and configuring `fail2ban` to protect against brute-force attacks.
22+
- Configuring a firewall (UFW) to allow only essential ports (SSH, HTTP, HTTPS).
23+
24+
### 2. Container & Dependency Scan Playbook (`container-dependency-scan.yml`)
25+
26+
This playbook is designed to run in a CI/CD pipeline and performs security scans on:
27+
- **Docker Images**: Uses `Trivy` to scan container images for known vulnerabilities (CVEs), failing the pipeline if critical issues are found.
28+
- **Python Dependencies**: Uses `Safety` to check for vulnerabilities in Python packages listed in a `requirements.txt` file.
29+
30+
## Prerequisites
31+
32+
- Ansible installed on the control node.
33+
- For `host-hardening.yml`: Target hosts must be accessible via SSH.
34+
- For `container-dependency-scan.yml`: Docker and Python/pip must be installed on the runner.
35+
36+
## Usage
37+
38+
### 1. Clone the Repository
39+
```bash
40+
git clone https://github.com/D3One/Vault-backup-automation/tree/main/Ansible%20samples
41+
cd ansible-devsecops-playbooks
42+
```
43+
44+
### 2. Create an Inventory File
45+
Create a file named `inventory.ini` to define your target hosts:
46+
```ini
47+
[webservers]
48+
web-server-1 ansible_host=192.168.1.10
49+
web-server-2 ansible_host=192.168.1.11
50+
51+
[local]
52+
localhost ansible_connection=local
53+
```
54+
55+
### 3. Run the Host Hardening Playbook
56+
```bash
57+
ansible-playbook -i inventory.ini host-hardening.yml --user <your-username> --become
58+
```
59+
60+
### 4. Run the Security Scan Playbook (in CI/CD)
61+
Example command to run the scan locally:
62+
```bash
63+
ansible-playbook -i inventory.ini container-dependency-scan.yml -e "image_name=my-app:latest requirements_path=./requirements.txt"
64+
```
65+
66+
## Example Integration in GitLab CI
67+
68+
```yaml
69+
stages:
70+
- security check
71+
72+
trivy_scan:
73+
stage: security check
74+
image: docker:latest
75+
services:
76+
- docker:dind
77+
before_script:
78+
- apk add --no-cache ansible
79+
script:
80+
- ansible-playbook -i localhost, -c local container-dependency-scan.yml
81+
artifacts:
82+
paths:
83+
- ./*security-scan-report*.txt
84+
```
85+
86+
## Key Benefits
87+
88+
- **Infrastructure as Code (IaC)**: Security policies are defined in code, versioned, and reviewable.
89+
- **Automation**: Eliminates manual security checks, reducing human error.
90+
- **Shift-Left Security**: Identifies vulnerabilities early in the development lifecycle.
91+
- **Compliance**: Helps enforce consistent security configurations across all environments.
92+
93+
## Contributing
94+
95+
Feel free to submit issues, fork the repository, and create pull requests to improve these playbooks.
96+
97+
## License
98+
99+
This project is licensed under the MIT License.
100+
101+
---
102+

‎Ansible samples/container-dependency-scan.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
- name: 🔍 SCAN: Container Image and Dependencies for Vulnerabilities
3+
hosts: localhost
4+
vars:
5+
image_name: "my-app:latest" # Имя сканируемого Docker-образа
6+
requirements_path: "requirements.txt" # Путь к файлу зависимостей Python
7+
8+
tasks:
9+
- name: "1. 🐳 Install Trivy (if not installed)"
10+
block:
11+
- name: Download Trivy installer
12+
ansible.builtin.get_url:
13+
url: "https://github.com/aquasecurity/trivy/releases/latest/download/trivy_0.49.1_Linux-64bit.deb"
14+
dest: "/tmp/trivy.deb"
15+
mode: '0755'
16+
- name: Install Trivy from .deb package
17+
ansible.builtin.apt:
18+
deb: "/tmp/trivy.deb"
19+
become: yes
20+
21+
- name: "2. 🔎 Scan local Docker image for vulnerabilities with Trivy"
22+
community.docker.docker_image_info:
23+
name: "{{ image_name }}"
24+
register: image_info
25+
26+
- name: Run Trivy scan and fail if critical vulnerabilities are found
27+
ansible.builtin.command:
28+
cmd: "trivy image --exit-code 1 --severity CRITICAL,HIGH {{ image_name }}"
29+
register: trivy_scan_result
30+
failed_when:
31+
- trivy_scan_result.rc != 0
32+
- "'ERROR' not in trivy_scan_result.stderr" # Игнорируем ошибки скачивания и т.д., но не ошибки наличия уязвимостей.
33+
34+
- name: "3. 🐍 Install Safety (Python vulnerability scanner)"
35+
ansible.builtin.pip:
36+
name: safety
37+
state: latest
38+
39+
- name: "4. 📦 Scan Python dependencies for known vulnerabilities"
40+
ansible.builtin.command:
41+
cmd: "safety check --file {{ requirements_path }} --full-report"
42+
register: safety_scan_result
43+
failed_when: safety_scan_result.rc != 0
44+
ignore_errors: yes # Можно изменить на 'no' для строгого режима
45+
46+
- name: "5. 📄 Save scan reports as artifacts (for CI/CD)"
47+
ansible.builtin.copy:
48+
content: |
49+
TRIVY SCAN REPORT:
50+
{{ trivy_scan_result.stdout }}
51+
52+
SAFETY SCAN REPORT:
53+
{{ safety_scan_result.stdout }}
54+
dest: "./security-scan-report-{{ ansible_date_time.epoch }}.txt"

‎Ansible samples/host-hardening.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
- name: 🔒 Apply Basic Server Hardening for DevSecOps
3+
hosts: all # Целевые хосты (можно указать группу в инвентаре)
4+
become: yes # Запуск с повышенными привилегиями (sudo)
5+
vars:
6+
# Список пользователей, которым разрешен SSH доступ
7+
allowed_ssh_users: "deployuser adminuser"
8+
# Список устаревших и небезопасных алгоритмов для отключения
9+
weak_kex_algorithms: "diffie-hellman-group1-sha1,diffie-hellman-group14-sha1"
10+
weak_ciphers: "3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc"
11+
12+
tasks:
13+
- name: "🛡️ 1. Ensure SSH root login is disabled"
14+
ansible.builtin.lineinfile:
15+
path: /etc/ssh/sshd_config
16+
regexp: '^#?PermitRootLogin'
17+
line: 'PermitRootLogin no'
18+
state: present
19+
notify: restart sshd
20+
21+
- name: "🛡️ 2. Configure allowed SSH users"
22+
ansible.builtin.lineinfile:
23+
path: /etc/ssh/sshd_config
24+
regexp: '^#?AllowUsers'
25+
line: "AllowUsers {{ allowed_ssh_users }}"
26+
state: present
27+
notify: restart sshd
28+
29+
- name: "🛡️ 3. Disable weak SSH Key Exchange Algorithms and Ciphers"
30+
ansible.builtin.lineinfile:
31+
path: /etc/ssh/sshd_config
32+
regexp: '^#?KexAlgorithms'
33+
line: "KexAlgorithms {{ weak_kex_algorithms }}"
34+
state: absent
35+
notify: restart sshd
36+
37+
- name: "🛡️ 4. Install and configure fail2ban to prevent brute-force attacks"
38+
ansible.builtin.package:
39+
name: fail2ban
40+
state: latest
41+
notify: restart fail2ban
42+
43+
- name: "🛡️ 5. Ensure firewall (UFW) is enabled and allows only SSH and HTTP/HTTPS"
44+
community.general.ufw:
45+
rule: allow
46+
name: "{{ item }}"
47+
state: enabled
48+
loop:
49+
- ssh
50+
- http
51+
- https
52+
ignore_errors: yes # На случай, если UFW не установлен
53+
54+
handlers:
55+
- name: restart sshd
56+
ansible.builtin.service:
57+
name: sshd
58+
state: restarted
59+
enabled: yes
60+
61+
- name: restart fail2ban
62+
ansible.builtin.service:
63+
name: fail2ban
64+
state: restarted
65+
enabled: yes

0 commit comments

Comments
 (0)