# Basic Ubuntu machine setup.
#
# Usage:
#
# 1. $ ansible-playbook ansible/roles/ubuntu.yml -i aaa.bbb.ccc.ddd,
# 2. $ ssh aaa.bbb.ccc.ddd
# 3. Install dotfiles!
---
- hosts: all
  remote_user: root
  vars:
    user: "{{ lookup('env', 'USER') }}"
  vars_prompt:
    password: "Please enter a password for the remote user to create/set"
  tasks:
    - name: update/upgrade apt
      apt: upgrade=dist update_cache=yes

    - name: add primary user
      user: name={{ user }} shell=/bin/bash groups=sudo append=yes password={{ password | password_hash('sha512') }}

    - name: upload primary user ssh public key
      authorized_key: user={{ user }} key="{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

    - name: disable root login (and other sshd_config tweaks)
      lineinfile: dest=/etc/ssh/sshd_config state={{ item.state }} line="{{ item.line }}"
      with_items:
        - { state: absent,  line: "PermitRootLogin yes" }
        - { state: present, line: "PermitRootLogin without-password" }
        - { state: present, line: "UseDNS no" }
        - { state: present, line: "AllowUsers {{ user }}" }
      notify:
        - reload ssh

  handlers:
    - name: reload ssh
      service: name=ssh state=restarted

# Basic Ubuntu machine setup.
#
# Usage:
#
# 1. $ ansible-playbook ansible/roles/ubuntu.yml -i aaa.bbb.ccc.ddd,
# 2. $ ssh aaa.bbb.ccc.ddd
# 3. Install dotfiles!
---
- hosts: all
  remote_user: root
  vars:
    user: "{{ lookup('env', 'USER') }}"
  vars_prompt:
    password: "Please enter a password for the remote user to create/set"
  tasks:
    - name: update/upgrade apt
      apt: upgrade=dist update_cache=yes

    - name: add primary user
      user: name={{ user }} shell=/bin/bash groups=sudo append=yes password={{ password | password_hash('sha512') }}

    - name: upload primary user ssh public key
      authorized_key: user={{ user }} key="{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

    - name: disable root ssh login, disallow password authentication (and other sshd_config tweaks)
      lineinfile: dest=/etc/ssh/sshd_config state={{ item.state }} line="{{ item.line }}" regex="{{ item.regex }}"
      with_items:
        - { state: present, line: "PermitRootLogin no", regexp: "^PermitRootLogin" }
        - { state: present, line: "PasswordAuthentication no", regexp: "^PasswordAuthentication" }
        - { state: present, line: "UseDNS no", regexp: "^UseDNS" }
        - { state: present, line: "AllowUsers {{ user }}" ,regexp: "^AllowUsers" }
      notify:
        - reload ssh

    - name: Install fail2ban
      apt: pkg=fail2ban state=present

  handlers:
    - name: reload ssh
      service: name=ssh state=restarted

Install fail2ban package and secure SSH even further
Install fail2ban package and secure SSH even further
