ansible/docs/SECURITY_HARDENING_PLAN.md

Security Hardening Implementation Plan

🔒 Security Hardening Role Structure

Phase 1: Antivirus Protection (ClamAV)

What gets installed:

- clamav-daemon      # Background scanning service
- clamav-freshclam   # Virus definition updates
- clamav-milter      # Email integration
- clamdscan          # Command-line scanner

What gets configured:

• Daily scans at 3 AM of critical directories
• Real-time monitoring of /home, /var/www, /tmp
• Automatic updates of virus definitions
• Email alerts for detected threats
• Quarantine system for suspicious files

Ansible tasks:

- name: Install ClamAV
  apt:
    name: [clamav-daemon, clamav-freshclam, clamdscan]
    state: present

- name: Configure daily scans
  cron:
    name: "Daily ClamAV scan"
    job: "/usr/bin/clamscan -r /home /var/www --log=/var/log/clamav/daily.log"
    hour: "3"
    minute: "0"

- name: Enable real-time scanning
  systemd:
    name: clamav-daemon
    enabled: true
    state: started

Phase 2: Security Auditing (Lynis)

What gets installed:

- lynis              # Security auditing tool
- rkhunter           # Rootkit hunter
- chkrootkit         # Additional rootkit detection

What gets configured:

• Weekly security audits with detailed reports
• Baseline security scoring for comparison
• Automated hardening of common issues
• Email reports to administrators
• Trend tracking of security improvements

Ansible tasks:

- name: Install Lynis
  get_url:
    url: "https://downloads.cisofy.com/lynis/lynis-3.0.8.tar.gz"
    dest: "/tmp/lynis.tar.gz"

- name: Extract and install Lynis
  unarchive:
    src: "/tmp/lynis.tar.gz"
    dest: "/opt/"
    remote_src: yes

- name: Create weekly audit cron
  cron:
    name: "Weekly Lynis audit"
    job: "/opt/lynis/lynis audit system --quick --report-file /var/log/lynis/weekly-$(date +\\%Y\\%m\\%d).log"
    weekday: "0"
    hour: "2"
    minute: "0"

Phase 3: Advanced Security Measures

File Integrity Monitoring (AIDE)

# Monitors critical system files for changes
- Tracks modifications to /etc, /bin, /sbin, /usr/bin
- Alerts on unauthorized changes
- Creates cryptographic checksums
- Daily integrity checks

Intrusion Detection (Fail2ban Enhancement)

# Already have basic fail2ban, enhance with:
- SSH brute force protection ✅ (already done)
- Web application attack detection
- Port scan detection
- DDoS protection rules
- Geographic IP blocking

System Hardening

# Kernel security parameters
- Disable unused network protocols
- Enable ASLR (Address Space Layout Randomization)
- Configure secure memory settings
- Harden network stack parameters

# Service hardening
- Disable unnecessary services
- Secure service configurations
- Implement principle of least privilege
- Configure secure file permissions

🎯 Implementation Strategy

Week 1: Basic Antivirus

# Create security role
mkdir -p roles/security/{tasks,templates,handlers,defaults}

# Implement ClamAV
- Install and configure ClamAV
- Set up daily scans
- Configure email alerts
- Test malware detection

Week 2: Security Auditing

# Add Lynis auditing
- Install Lynis security scanner
- Configure weekly audits
- Create reporting dashboard
- Baseline current security score

Week 3: Advanced Hardening

# Implement AIDE and enhanced fail2ban
- File integrity monitoring
- Enhanced intrusion detection
- System parameter hardening
- Security policy enforcement

📊 Expected Benefits

Immediate (Week 1)

• ✅ Malware protection on all systems
• ✅ Automated threat detection
• ✅ Real-time file monitoring

Short-term (Month 1)

• ✅ Security baseline established
• ✅ Vulnerability identification
• ✅ Automated hardening applied
• ✅ Security trend tracking

Long-term (Ongoing)

• ✅ Proactive threat detection
• ✅ Compliance reporting
• ✅ Reduced attack surface
• ✅ Security incident prevention

🚨 Security Alerts & Monitoring

Alert Types:

1. Critical: Malware detected, system compromise
2. High: Failed security audit, integrity violation
3. Medium: Suspicious activity, configuration drift
4. Low: Routine scan results, update notifications

Notification Methods:

• Email alerts for critical/high priority
• Log aggregation in centralized system
• Dashboard indicators in monitoring system
• Weekly reports with security trends

🔧 Integration with Existing Infrastructure

Works with your current setup:

• ✅ Fail2ban - Enhanced with more rules
• ✅ UFW firewall - Additional hardening rules
• ✅ SSH hardening - Extended with key rotation
• ✅ Monitoring - Security metrics integration
• ✅ Maintenance - Security updates automation

Complements Proxmox + NAS:

• File-level protection vs. VM snapshots
• Real-time detection vs. snapshot recovery
• Proactive prevention vs. reactive restoration
• Security compliance vs. data protection

📋 Next Steps

1. Create security role structure
2. Implement ClamAV antivirus protection
3. Add Lynis security auditing
4. Configure monitoring integration
5. Test and validate security improvements

Would you like me to start implementing the security role?