Add fail2ban and ssh security setups to setup ansible playbook

playbooks/01-setup.yml

@@ -1,4 +1,4 @@
-- name: Download K3s Setup Script and K8s Python Lib on All Nodes
+- name: Install K3s and Apply Security Configurations on All Nodes
   hosts: all
   become: true
   tasks:
@@ -23,6 +23,48 @@
       ansible.builtin.command: ufw disable
       changed_when: false
 
+    - name: Disable password authentication for SSH
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+        backup: true
+
+    - name: Disable root password login
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^PermitRootLogin'
+        line: 'PermitRootLogin prohibit-password'
+        state: present
+        backup: true
+
+    - name: Restart SSH to apply config
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+
+    - name: Install fail2ban
+      ansible.builtin.apt:
+        name: fail2ban
+        state: present
+        update_cache: true
+
+    - name: Configure fail2ban for SSH
+      ansible.builtin.blockinfile:
+        path: /etc/fail2ban/jail.local
+        create: true
+        block: |
+          [sshd]
+          enabled = true
+          port    = ssh
+          logpath = /var/log/auth.log
+          maxretry = 5
+          bantime  = 3600
+        mode: '0644'
+      notify:
+        - restart fail2ban
+
 - name: Set up K3s on Init Node
   hosts: init
   become: true