new version

roles/01-server_hardening/templates/fail2ban-jail.local.j2

@@ -1,30 +1,12 @@
-# {{ ansible_managed }}
+# Configuration Fail2Ban générée par Ansible
+
 [DEFAULT]
-ignoreip = 127.0.0.1/8 ::1
-bantime = {{ fail2ban_bantime }}
-findtime = {{ fail2ban_findtime }}
-maxretry = {{ fail2ban_maxretry }}
-backend = systemd
+bantime = {{ fail2ban_jail_ssh_bantime }}
+findtime = 600
+maxretry = {{ fail2ban_jail_ssh_maxretry }}
 
 [sshd]
-enabled = true
+enabled = {{ fail2ban_jail_ssh_enabled | lower }}
 port = {{ ssh_port }}
 filter = sshd
-logpath = /var/log/auth.log
-maxretry = {{ fail2ban_maxretry }}
-
-[sshd-ddos]
-enabled = true
-port = {{ ssh_port }}
-filter = sshd-ddos
-logpath = /var/log/auth.log
-maxretry = 10
-
-[minecraft]
-enabled = true
-port = {{ minecraft_port | default(25565) }}
-filter = minecraft
-logpath = {{ minecraft_server_dir | default('/opt/minecraft/server') }}/logs/latest.log
-maxretry = 10
-findtime = 600
-bantime = 3600
+logpath = /var/log/auth.log

roles/01-server_hardening/templates/sshd_config.j2

@@ -1,47 +1,21 @@
-# {{ ansible_managed }}
-# SSH Server Configuration
-
+# Configuration SSH sécurisée générée par Ansible
 Port {{ ssh_port }}
 Protocol 2
-HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_ed25519_key
 
-# Logging
-SyslogFacility AUTH
-LogLevel INFO
-
-# Authentication
-LoginGraceTime 120
+# Authentification
 PermitRootLogin {{ ssh_permit_root_login }}
-StrictModes yes
-MaxAuthTries {{ ssh_max_auth_tries }}
-MaxSessions {{ ssh_max_sessions }}
-
-PubkeyAuthentication {{ ssh_pubkey_authentication }}
-AuthorizedKeysFile .ssh/authorized_keys
-
 PasswordAuthentication {{ ssh_password_authentication }}
-PermitEmptyPasswords no
-ChallengeResponseAuthentication no
+MaxAuthTries {{ ssh_max_auth_tries }}
+PubkeyAuthentication yes
 
-# Security
-IgnoreRhosts yes
-HostbasedAuthentication no
-X11Forwarding no
-PrintMotd no
-PrintLastLog yes
-TCPKeepAlive yes
-Compression delayed
-
-# Client alive
+# Sessions
 ClientAliveInterval {{ ssh_client_alive_interval }}
 ClientAliveCountMax {{ ssh_client_alive_count_max }}
 
-# Allow only ansible user
-AllowUsers ansible
-
-# Disable unused features
+# Sécurité
+X11Forwarding no
 UsePAM yes
-Banner none
-AcceptEnv LANG LC_*
-Subsystem sftp /usr/lib/openssh/sftp-server
+UseDNS no
+
+# Utilisateurs autorisés
+AllowUsers {{ allowed_ssh_users | join(' ') }}

roles/01-server_hardening/templates/ufw-rules.j2

@@ -1,16 +0,0 @@
-# {{ ansible_managed }}
-# UFW Rules Configuration
-
-# Allow SSH
--A ufw-user-input -p tcp --dport {{ ssh_port }} -j ACCEPT
-
-# Allow Minecraft
--A ufw-user-input -p tcp --dport {{ minecraft_port | default(25565) }} -j ACCEPT
-
-# Allow RCON if enabled
-{% if enable_rcon | default(false) %}
--A ufw-user-input -p tcp --dport {{ rcon_port | default(25575) }} -j ACCEPT
-{% endif %}
-
-# Drop everything else
--A ufw-user-input -j DROP