From da1971060af58a59d46f96e4787a45939e8b9aed Mon Sep 17 00:00:00 2001
From: Rafael Bradley <rafabradleyrb@gmail.com>
Date: Sun, 17 Aug 2025 20:36:00 -0300
Subject: [PATCH] Add fail2ban and ssh security setups to setup ansible
 playbook

---
 playbooks/01-setup.yml | 44 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/playbooks/01-setup.yml b/playbooks/01-setup.yml
index dc2d838..6d5e071 100644
--- a/playbooks/01-setup.yml
+++ b/playbooks/01-setup.yml
@@ -1,4 +1,4 @@
-- name: Download K3s Setup Script and K8s Python Lib on All Nodes
+- name: Install K3s and Apply Security Configurations on All Nodes
   hosts: all
   become: true
   tasks:
@@ -23,6 +23,48 @@
       ansible.builtin.command: ufw disable
       changed_when: false
 
+    - name: Disable password authentication for SSH
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+        backup: true
+
+    - name: Disable root password login
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^PermitRootLogin'
+        line: 'PermitRootLogin prohibit-password'
+        state: present
+        backup: true
+
+    - name: Restart SSH to apply config
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+
+    - name: Install fail2ban
+      ansible.builtin.apt:
+        name: fail2ban
+        state: present
+        update_cache: true
+
+    - name: Configure fail2ban for SSH
+      ansible.builtin.blockinfile:
+        path: /etc/fail2ban/jail.local
+        create: true
+        block: |
+          [sshd]
+          enabled = true
+          port    = ssh
+          logpath = /var/log/auth.log
+          maxretry = 5
+          bantime  = 3600
+        mode: '0644'
+      notify:
+        - restart fail2ban
+
 - name: Set up K3s on Init Node
   hosts: init
   become: true