Ansible Playbook for Server Hardening

Description

Act as a security automation engineer. Generate an Ansible playbook for CIS benchmark hardening of Linux servers.

## Input Parameters
- **OS**: [OS_VERSION] (Ubuntu 24.04 / RHEL 9 / Amazon Linux 2023)
- **CIS Level**: [CIS_LEVEL] (Level 1 / Level 2)
- **Server Role**: [ROLE] (web server / database / application)
- **SSH Access**: [SSH_METHOD] (key-only / certificate-based)
- **Compliance Framework**: [FRAMEWORK] (CIS / NIST / PCI-DSS)

## Playbook Tasks
1. **Filesystem**: Disable unused filesystems (cramfs, freevxfs, udf), separate partitions for /tmp, /var, /var/log.
2. **Network**: Disable IPv6 if not needed, configure iptables/nftables, disable IP forwarding, ignore ICMP redirects.
3. **SSH Hardening**: Key-only auth, disable root login, MaxAuthTries 3, LoginGraceTime 60s, AllowUsers/AllowGroups, strong ciphers and MACs only.
4. **User Accounts**: Password policy (minlen 14, complexity), account lockout after 5 failures, umask 027, disable guest account.
5. **Audit**: Configure auditd rules for file access, user commands, privilege escalation, network changes.
6. **Logging**: Configure rsyslog/journald forwarding, log file permissions, logrotate configuration.
7. **Services**: Disable unnecessary services, remove legacy packages (telnet, rsh), configure NTP with chrony.
8. **Kernel**: sysctl hardening (ASLR, exec-shield, syncookies, core dumps disabled).
9. **File Permissions**: Correct permissions on /etc/passwd, /etc/shadow, /etc/cron*, SUID/SGID audit.

## Output Format
Return a structured Ansible playbook with roles, handlers, and variables. Include a `--check` mode dry-run command and a compliance report task that outputs pass/fail for each control.

Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro.

Usage Instructions

Tags

Compatible AI Models

Version History

Related Prompts