securitycheck.yml

- name: Check security of Linux
  hosts: all
  
  become: yes
  become_user: root
  
  tasks:
    - name: Check for SSH root login
      shell: grep "PermitRootLogin" /etc/ssh/sshd_config | awk '{print $2}'
      register: ssh_root_login
    - name: Print SSH root login status
      debug:
        msg: "SSH root login is {{ ssh_root_login.stdout }}"
    - name: Check for password authentication in SSH
      shell: grep "PasswordAuthentication" /etc/ssh/sshd_config | awk '{print $2}'
      register: ssh_password_auth
    - name: Print SSH password authentication status
      debug:
        msg: "SSH password authentication is {{ ssh_password_auth.stdout }}"
    - name: Check for password policy
      shell: grep "PASS_MAX_DAYS\|PASS_MIN_DAYS\|PASS_WARN_AGE" /etc/login.defs
      register: password_policy
    - name: Print password policy
      debug:
        msg: "{{ password_policy.stdout }}"
    - name: Check for firewall rules
      shell: ufw status
      register: firewall_rules
    - name: Print firewall rules
      debug:
        msg: "{{ firewall_rules.stdout }}"
#    - name: Check for SELinux status
#      shell: sestatus
#      register: selinux_status
#    - name: Print SELinux status
#      debug:
#        msg: "{{ selinux_status.stdout }}"