CYBER-0 initial concept ready

2026-09-22 00:00:45 +02:00
parent 29eecd4f70
commit edb6cde069
70 changed files with 1976 additions and 3140 deletions
@@ -0,0 +1,92 @@
+---
+- name: "Demo: Ubuntu SSH and nginx checks"
+  hosts: linux_vms
+  gather_facts: true
+  become: false
+  vars:
+    report_dir: "./artifacts/raw/ansible"
+
+  pre_tasks:
+    - name: "Ensure report directory exists"
+      ansible.builtin.file:
+        path: "{{ report_dir }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+      run_once: true
+
+  tasks:
+    - name: "Gather SSH effective configuration"
+      ansible.builtin.shell: grep -Ei '^(PasswordAuthentication|PermitRootLogin)' /etc/ssh/sshd_config
+      register: sshd_config
+      changed_when: false
+
+    - name: "Record SSH password authentication result"
+      ansible.builtin.set_fact:
+        test_results: "{{ test_results | default([]) + [{
+          'test_id': 'DEMO-SSH-01',
+          'category': 'Secure remote administration',
+          'requirement': 'IEC 62443-3-3 SR 1.7',
+          'description': 'SSH password authentication shall be disabled',
+          'passed': ('passwordauthentication no' in sshd_config.stdout),
+          'expected': 'PasswordAuthentication no',
+          'actual': sshd_config.stdout_lines | select('match', '^passwordauthentication ') | first | default('not found'),
+          'severity': 'high',
+          'remediation': 'Disable SSH password authentication and use managed keys'
+        }] }}"
+
+    - name: "Gather nginx configuration"
+      ansible.builtin.shell: grep -E '^[[:space:]]*ssl_(protocols|ciphers)' /etc/nginx/sites-enabled/default
+      register: nginx_config
+      changed_when: false
+
+    - name: "Record obsolete TLS protocol result"
+      ansible.builtin.set_fact:
+        test_results: "{{ test_results + [{
+          'test_id': 'DEMO-TLS-01',
+          'category': 'Secure communications',
+          'requirement': 'IEC 62443-3-3 SR 4.1',
+          'description': 'The web server shall allow only TLS 1.2 and TLS 1.3',
+          'passed': ('TLSv1 ' not in nginx_config.stdout and 'TLSv1.1' not in nginx_config.stdout),
+          'expected': 'ssl_protocols TLSv1.2 TLSv1.3',
+          'actual': nginx_config.stdout_lines | select('search', 'ssl_protocols') | first | default('not found'),
+          'severity': 'high',
+          'remediation': 'Remove TLSv1 and TLSv1.1 from ssl_protocols'
+        }] }}"
+
+    - name: "Record weak CBC cipher result"
+      ansible.builtin.set_fact:
+        test_results: "{{ test_results + [{
+          'test_id': 'DEMO-TLS-02',
+          'category': 'Secure communications',
+          'requirement': 'IEC 62443-3-3 SR 4.1',
+          'description': 'The web server shall not enable legacy CBC cipher suites',
+          'passed': ('AES128-SHA' not in nginx_config.stdout),
+          'expected': 'Modern AEAD cipher suites only',
+          'actual': nginx_config.stdout_lines | select('search', 'ssl_ciphers') | first | default('not found'),
+          'severity': 'medium',
+          'remediation': 'Use a modern Mozilla intermediate TLS cipher configuration'
+        }] }}"
+
+    - name: "Check nginx process"
+      ansible.builtin.command: pgrep -x nginx
+      register: nginx_process
+      changed_when: false
+      failed_when: false
+
+    - name: "Record nginx availability result"
+      ansible.builtin.set_fact:
+        test_results: "{{ test_results + [{
+          'test_id': 'DEMO-SVC-01',
+          'category': 'Service availability',
+          'requirement': 'IEC 62443-3-3 SR 7.1',
+          'description': 'The nginx service shall be running',
+          'passed': (nginx_process.rc == 0),
+          'expected': 'At least one nginx process',
+          'actual': nginx_process.stdout | default('not running', true),
+          'severity': 'medium',
+          'remediation': 'Start nginx and configure service supervision'
+        }] }}"
+
+    - name: "Generate raw Ansible report"
+      ansible.builtin.include_tasks: library/report.yml