Security and Networking

Security and Networking

SSH hardening

The role writes /etc/ssh/sshd_config.d/00-ansible-hardening.conf, validates it with sshd -t, and configures Ubuntu SSH socket activation.

The default policy:

ssh_hardening_port: 22571
ssh_hardening_permit_root_login: "no"
ssh_hardening_password_authentication: "no"
ssh_hardening_kbd_interactive_authentication: "no"
ssh_hardening_challenge_response_authentication: "no"
ssh_hardening_pubkey_authentication: "yes"
ssh_hardening_allow_tcp_forwarding: "no"
ssh_hardening_allow_agent_forwarding: "no"
ssh_hardening_x11_forwarding: "no"

By default, only bootstrap_login_user_name is allowed. Add users deliberately through ssh_hardening_allow_users if required.

Inspect the effective server configuration:

sudo sshd -T | sort
sudo systemctl status ssh.socket ssh.service

IPv4 firewall

The firewall role writes /etc/iptables/rules.v4, validates it with iptables-restore --test, and enables netfilter-persistent.

Default policy:

• INPUT DROP
• FORWARD DROP
• OUTPUT ACCEPT
• accept loopback and established/related connections
• accept configured TCP/UDP ports
• reject remaining inbound traffic

Baseline hosts permit only the hardened SSH port. traefik_hosts also permits TCP 80 and 443.

Check live and persisted rules:

sudo iptables -S INPUT
sudo iptables -S TCP_IN
sudo iptables-restore --test /etc/iptables/rules.v4

Do not use UFW or hand-edit /etc/iptables/rules.v4 on a managed host. Setup will replace manual changes on its next run.

IPv6

The firewall role disables IPv6 immediately and persistently through /etc/sysctl.d/99-ansible-disable-ipv6.conf. This project is an IPv4 firewall configuration. Do not expose services over IPv6 unless you deliberately change that design and add equivalent IPv6 controls.

Cloud firewall and NAT

Local iptables is not your cloud firewall. Allow the following upstream before the corresponding service needs them:

Port	When needed
22	Initial setup only, if this is the server's current SSH port.
22571	Hardened SSH default.
80	Traefik HTTP-to-HTTPS redirect and ACME HTTP-01.
443	Traefik HTTPS and TLS passthrough.

CrowdSec

CrowdSec runs on every host with rsyslog, cron, and the iptables firewall bouncer. Baseline acquisition reads /var/log/auth.log with the crowdsecurity/sshd collection.

traefik_hosts additionally gets the crowdsecurity/traefik collection, acquires /opt/traefik/logs/access.log, and applies bouncer decisions to both INPUT and DOCKER-USER.

The role removes package-generated duplicate acquisitions and keeps only role-managed files in /etc/crowdsec/acquis.d/.

Verify it:

sudo systemctl is-active crowdsec crowdsec-firewall-bouncer
sudo cscli collections list
sudo cscli metrics
sudo find /etc/crowdsec/acquis.d -maxdepth 1 -type f -printf '%f\n' | sort

Expected baseline acquisition: sshd.yaml. A Traefik host should also have traefik.yaml.