raspbian
ansible-raspbian
This role will setup a secure basic Raspbian environment with sensible defaults.
It will:
- Install specified system packages.
- Configure hostname.
- Configure locale.
- Mount tmpfs on write-intensive directories to increase the lifespan of SD-card.
- Change the password on default user.
- Set the default editor.
- Setup a secure SSH configuration.
- Configure UFW.
- Configure /boot/config.txt.
- Run raspi-config.
- Configure Postfix to send email through an SMTP relay.
- Enable unattended-upgrades.
- Install Fail2ban.
- Configure Logwatch to send weekly reports.
It will not:
- Update system packages.
- Run
apt-get update
. Please do this in a pre_task. See Example Playbook. - Install security patches but unattended-upgrades should take care of that.
Setup
- Install python requirements by running
pip install -r requirements.txt
. - Install sshpass by running
sudo apt-get install sshpass
. - Flash SD-card with Raspbian Stretch Lite.
- Add empty file named
ssh
in boot-partition of the flashed SD-card. - Optional: To enable wifi place a file called
wpa_supplicant.conf
in the boot-partition of the flashed SD-card with the following content:
network={
ssid="your ssid"
psk="your password"
}
- Run playbook.
Inventory
sshpass is required to make the first Ansible run
with the default password raspberry
. Password authentication over SSH will then be disabled in
preference of public key authentication with keys specified in ssh_public_keys
.
Your inventory should contain the following:
[all:vars]
ansible_connection=ssh
ansible_user=pi
ansible_ssh_pass=raspberry
Variables
# Sets the system hostname
system_hostname: "raspberrypi"
# The system password for ansible_ssh_user (should configured as pi).
# NOTE: Should be changed to something secure.
system_ssh_user_password: "raspberry"
# The password salt to use.
# NOTE: Should be changed to something secure and random.
system_ssh_user_salt: "salt"
# The system locale
system_locale: "en_US.UTF-8"
# The system timezone
system_timezone: "Europe/Stockholm"
# List dictionaries of desired tmpfs mounts.
system_tmpfs_mounts:
- { src: "/run", size: "10%", options: "nodev,noexec,nosuid" }
- { src: "/tmp", size: "10%", options: "nodev,nosuid" }
- { src: "/var/log", size: "10%", options: "nodev,noexec,nosuid" }
# apt-get installs listed packages
system_packages: []
# Path to default editor
system_default_editor_path: "/usr/bin/vi"
# Logwatch cache directory
logwatch_tmp_dir: /var/cache/logwatch
# Email which receives Logwatch reports
logwatch_mailto: "root"
# Logwatch report detail level
logwatch_detail: "Low"
# How often to receive Logwatch report, can be set to weekly and daily
logwatch_interval: "weekly"
postfix_hostname: "{{ ansible_hostname }}"
postfix_mailname: "{{ ansible_hostname }}"
postfix_mydestination:
- "{{ postfix_hostname }}"
- localdomain
- localhost
- localhost.localdomain
postfix_relayhost: smtp.gmail.com
postfix_relayhost_port: 587
# Required field, set this to your Gmail-address
postfix_sasl_user:
# Required field, set this to your Gmail password
postfix_sasl_password:
postfix_smtp_tls_cafile: /etc/ssl/certs/ca-certificates.crt
# Updates /boot/config.txt with `{{ key }}: {{ value }}`
rpi_boot_config: {}
# run raspi-config -noint do_{{ key }} {{ value }]. Options: https://github.com/raspberrypi-ui/rc_gui/blob/master/src/rc_gui.c#L23-L70
rpi_cmdline_config: {}
ssh_sshd_config: "/etc/ssh/sshd_config"
# Required field, list of ssh public keys to update ~/.authorized_keys.
# Note: One of these keys needs to be one that Ansible is using.
ssh_public_keys: []
# String to present when connecting to host over ssh
ssh_banner:
# UFW rules should always allow SSH to keep Ansible functioning
ufw_rules:
- { rule: "allow", port: "22", proto: "tcp" }
# Configures if igmp traffic should be allowed
ufw_allow_igmp: false
# Recipient of unattended-upgrades report
unattended_upgrades_email_address: root
# Should we reboot when /var/run/reboot-required is found?
unattended_upgrades_auto_reboot: false
# Internal variable used when running tests - should not be used.
ansible_raspbian_testing: false
Example Playbook
- hosts: servers
become: true
pre_tasks:
- name: update apt cache
apt:
cache_valid_time: 600
roles:
- role: hannseman.raspbian
vars:
system_packages:
- apt-transport-https
- vim
system_default_editor_path: "/usr/bin/vim.basic"
system_ssh_user_password: hunter2
system_ssh_user_salt: pepper
postfix_sasl_user: [email protected]
postfix_sasl_password: hunter2
ssh_public_keys:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXTGInmtpoG9rYmT/3DpL+0o/sH2shys+NwJLo8NnCj