dev-sec ansible-collection-hardening: tested hardening roles for Linux, SSH and nginx
An Ansible collection that applies a well-documented hardening baseline to Linux hosts, the SSH server and client, nginx and MySQL, with every setting adjustable through variables.
Drafted with AI from official documentation. Scripts were run in a test environment and repository links verified. Awaiting a human check. Did it work for you? Last edited Outdated?
dev-sec/ansible-collection-hardening
- Stars
- 5.5k
- Forks
- 839
- Language
- Jinja
- Licence
- Apache-2.0
- Last push
- 13 Oct 2026
On GitHub: This Ansible collection provides battle tested hardening for Linux, SSH, nginx, MySQL
Open on GitHubansible-collection-hardening (about 5,500 stars on GitHub) is the Ansible part of the DevSec Hardening Framework. Its roles encode the server hardening steps you would otherwise do by hand, and many more: os_hardening (kernel parameters, login definitions, file permissions, PAM, removing unneeded packages), ssh_hardening (a strict sshd_config and ssh_config with modern algorithms), nginx_hardening and mysql_hardening. Each role is tested against current Debian, Ubuntu, RHEL-family, Fedora, SUSE and Arch releases, and every default can be overridden with a variable.
When to use it
- You manage more than a couple of servers with Ansible and want the same baseline on all of them, applied again after every change.
- You need to show what your baseline is: the roles are readable and mirror the CIS and DevSec recommendations, so the playbook doubles as documentation.
- Not for a single hand-managed box, where the 30-minute hardening guide in this topic is faster and easier to understand.
How to try it
ansible-galaxy collection install devsec.hardening- hosts: webservers
become: true
collections:
- devsec.hardening
roles:
- role: devsec.hardening.os_hardening
- role: devsec.hardening.ssh_hardening
vars:
ssh_permit_root_login: "no"
ssh_allow_tcp_forwarding: "no"
ssh_allow_users: "deploy"Careful: ssh_hardening rewrites sshd_config and disables password login. Run it first against a test VM, read the role’s variable list, make sure your key already works for the account you will use, and keep a session open on the target while the playbook runs for the first time. ansible-playbook --check --diff previews the changes without applying them.
Credit
The collection is maintained by the DevSec Hardening Framework team (dev-sec) and contributors, and is released under the Apache-2.0 license.
Did this work for you?
No votes yet. Be the first.
If it did not work, the report form below tells the editors what went wrong.
See also
- 0181 Ansible concepts: inventory, modules, playbooks, idempotency and roles Ansible configures many servers over SSH from one control machine. Learn the core pieces: inventory, modules, tasks, playbooks, roles, and why runs… Beginner · Explains an idea · Linux, macOS Article Ansible 15 Oct 2026
- 0182 Your first Ansible playbook: install nginx and publish a page A complete beginner playbook that installs nginx on Debian or Ubuntu servers, starts it at boot and deploys a home page, with… Beginner · Step by step · Linux, macOS Script Ansible 15 Oct 2026
- 0183 Ansible variables, templates and handlers: configure an nginx site Use group variables, Jinja2 templates and handlers together: render an nginx server block from variables, test the config and reload nginx only… Intermediate · Step by step · Linux, macOS Script Ansible 15 Oct 2026
- 0184 Ansible Vault: keep passwords and keys encrypted in your repo Ansible Vault encrypts variable files or single values so secrets can live in Git next to your playbooks. Create, edit and rekey… Advanced · Step by step · Linux, macOS Article Ansible 15 Oct 2026
- 0185 Ansible ad-hoc commands cheat sheet One-line ansible commands for quick jobs across many servers: ping hosts, run a command, copy files, manage packages, users and services, gather… Intermediate · Cheat sheet · Linux, macOS Article Ansible 15 Oct 2026
- 0186 Fix: Ansible UNREACHABLE! Failed to connect to the host via ssh Ansible could not open an SSH session to the host, so no task ran. The text after the colon tells you why:… Intermediate · Fixes an error · Linux, macOS Article Ansible · SSH & servers 15 Oct 2026
History
Every saved edit is kept. The plot on the sleeve draws one line per edit. Open any edit to see exactly what changed.
- Dominik +1,907 chars