# Ansible Hardening

> >

- **Type:** Skill
- **Install:** `agentstack add skill-scoobydont-666-shared-claude-skills-ansible-hardening`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [scoobydont-666](https://agentstack.voostack.com/s/scoobydont-666)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [scoobydont-666](https://github.com/scoobydont-666)
- **Source:** https://github.com/scoobydont-666/shared-claude-skills/tree/main/skills/ansible-hardening

## Install

```sh
agentstack add skill-scoobydont-666-shared-claude-skills-ansible-hardening
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Ansible Hardening

Codify manual security work into idempotent Ansible roles. Every hardening step
performed by hand should eventually become a role in this collection.

## Roles Needed (from manual work done 2026-03-21)

### crowdsec
Installs CrowdSec agent + firewall bouncer, configures collections, whitelists LAN.
```yaml
# defaults
crowdsec_lapi_port: 8088          # moved from 8080 for OpenShell
crowdsec_collections:
  - crowdsecurity/sshd
  - crowdsecurity/linux
crowdsec_whitelist_cidrs:
  - "{{ lan_subnet }}"
```

### fail2ban
Installs fail2ban, configures SSH jail.
```yaml
# defaults
fail2ban_maxretry: 3
fail2ban_bantime: 3600
fail2ban_findtime: 600
```

### auditd
Installs auditd, deploys audit rules for sensitive files.
```yaml
# defaults
auditd_watch_paths:
  - { path: /etc/sudoers, key: sudoers_changes }
  - { path: /etc/sudoers.d/, key: sudoers_changes }
  - { path: /etc/ssh/sshd_config, key: ssh_config }
  - { path: /etc/monero/, key: monero_config }
```

### tailscale
Installs Tailscale, configures serve endpoints.
```yaml
# defaults
tailscale_serve_ports: []         # list of {local_port, description}
tailscale_funnel: false           # never enable funnel by default
```
Note: `tailscale up` requires interactive auth — role should detect and prompt.

### semaphore
Installs Semaphore binary, creates config + systemd unit.
```yaml
# defaults
semaphore_version: "2.17.27"
semaphore_port: 3001
semaphore_bind: "127.0.0.1"
semaphore_db: bolt                # bolt or postgres
```

### sudoers-scope
Replaces blanket NOPASSWD with scoped command list.
```yaml
# defaults
sudoers_nopasswd_commands:
  - /usr/bin/systemctl
  - /usr/bin/journalctl
  - /usr/bin/apt
  - /usr/bin/apt-get
  # ... full list from /etc/sudoers.d/admin_user
```

## Implementation Pattern

Each role follows monero-farm conventions:
- `defaults/main.yml` — all variables with safe defaults
- `tasks/main.yml` — idempotent tasks
- `handlers/main.yml` — restart/reload handlers
- `templates/` — config file templates (Jinja2)

## Rules

- Always `--check --diff` before real runs
- Never remove existing security controls — only add/tighten
- Whitelist LAN subnet before enabling firewall bouncers
- Tailscale auth is interactive — can't be fully automated
- Test on a primary host first, then roll to fleet

## Where To Build

These roles belong in your project's `ansible/roles/` directory alongside existing
roles (base, application-specific, monitoring). The security roles extend
the base role's hardening.

Alternatively, create a standalone `ansible-hardening` collection at
`/ansible-hardening/` if the scope grows and needs to be reused
across multiple projects.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [scoobydont-666](https://github.com/scoobydont-666)
- **Source:** [scoobydont-666/shared-claude-skills](https://github.com/scoobydont-666/shared-claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-scoobydont-666-shared-claude-skills-ansible-hardening
- Seller: https://agentstack.voostack.com/s/scoobydont-666
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.