Ansible for Preemptive Cybersecurity — Predictive Defense Automation

---
- name: Attack surface discovery
  hosts: all
  become: true
  tasks:
    - name: Discover listening services
      ansible.builtin.shell: ss -tlnp | tail -n +2
      register: listening_services
      changed_when: false

    - name: Discover open ports
      ansible.builtin.shell: ss -tlnp | awk '{print $4}' | grep -oP ':\K\d+' | sort -un
      register: open_ports
      changed_when: false

    - name: Flag unexpected services
      ansible.builtin.debug:
        msg: "⚠️ Unexpected port {{ item }} on {{ inventory_hostname }}"
      loop: "{{ open_ports.stdout_lines }}"
      when: item | int not in allowed_ports[group_names[0]] | default([22, 80, 443])

    - name: Check for world-readable sensitive files
      ansible.builtin.find:
        paths: [/etc, /opt, /home]
        patterns: ["*.key", "*.pem", "*.env", "*password*", "*secret*"]
        recurse: true
        file_type: file
      register: sensitive_files

    - name: Flag overly permissive sensitive files
      ansible.builtin.debug:
        msg: "⚠️ {{ item.path }} mode={{ item.mode }}"
      loop: "{{ sensitive_files.files }}"
      when: item.mode is match('.*[4567][4567][4567]')

    - name: Check for SUID binaries
      ansible.builtin.command: find / -perm -4000 -type f 2>/dev/null
      register: suid_binaries
      changed_when: false

    - name: Flag unexpected SUID binaries
      ansible.builtin.debug:
        msg: "⚠️ SUID binary: {{ item }}"
      loop: "{{ suid_binaries.stdout_lines }}"
      when: item not in known_suid_binaries | default(['/usr/bin/sudo', '/usr/bin/passwd', '/usr/bin/ping'])

- name: Preemptive vulnerability scan
  hosts: all
  become: true
  tasks:
    - name: Check for outdated packages with known CVEs
      ansible.builtin.shell: |
        {% if ansible_os_family == "Debian" %}
        apt list --upgradable 2>/dev/null | grep -i security | head -20
        {% else %}
        yum updateinfo list security 2>/dev/null | head -20
        {% endif %}
      register: security_updates
      changed_when: false

    - name: Count pending security updates
      ansible.builtin.set_fact:
        security_update_count: "{{ security_updates.stdout_lines | length }}"

    - name: Alert on critical security updates
      ansible.builtin.debug:
        msg: "🚨 {{ inventory_hostname }}: {{ security_update_count }} pending security updates"
      when: security_update_count | int > 0

    - name: Auto-apply critical security patches
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
      when:
        - ansible_os_family == "Debian"
        - auto_patch | default(false)
        - security_update_count | int > 0

    - name: Check SSL certificate expiry
      ansible.builtin.shell: |
        for cert in $(find /etc/ssl /etc/nginx /etc/letsencrypt -name "*.pem" -o -name "*.crt" 2>/dev/null); do
          expiry=$(openssl x509 -in "$cert" -noout -enddate 2>/dev/null | cut -d= -f2)
          if [ -n "$expiry" ]; then
            echo "$cert|$expiry"
          fi
        done
      register: cert_expiry
      changed_when: false

    - name: Flag expiring certificates
      ansible.builtin.debug:
        msg: "⚠️ Certificate expiring: {{ item }}"
      loop: "{{ cert_expiry.stdout_lines }}"
      when: item | length > 0

- name: Automated threat hunting
  hosts: all
  become: true
  tasks:
    - name: Hunt for unauthorized SSH keys
      ansible.builtin.find:
        paths: /home
        patterns: authorized_keys
        recurse: true
      register: ssh_keys

    - name: Check SSH keys against known list
      ansible.builtin.shell: |
        cat {{ item.path }} | ssh-keygen -lf - 2>/dev/null
      loop: "{{ ssh_keys.files }}"
      register: key_fingerprints
      changed_when: false

    - name: Hunt for cryptominer indicators
      ansible.builtin.shell: |
        ps aux | grep -iE 'xmrig|minerd|cpuminer|stratum' | grep -v grep
      register: miner_check
      changed_when: false
      failed_when: false

    - name: Alert on cryptominer detection
      ansible.builtin.debug:
        msg: "🚨 CRYPTOMINER DETECTED on {{ inventory_hostname }}: {{ miner_check.stdout }}"
      when: miner_check.stdout | length > 0

    - name: Hunt for reverse shells
      ansible.builtin.shell: |
        ss -tnp | grep ESTAB | awk '{print $5, $6}' | grep -vE '({{ allowed_outbound_ips | join("|") }})'
      register: suspicious_connections
      changed_when: false

    - name: Hunt for recently modified system binaries
      ansible.builtin.find:
        paths: [/usr/bin, /usr/sbin, /bin, /sbin]
        age: "-7d"
        file_type: file
      register: modified_binaries

    - name: Flag recently modified system binaries
      ansible.builtin.debug:
        msg: "⚠️ System binary modified in last 7d: {{ item.path }} ({{ item.mtime }})"
      loop: "{{ modified_binaries.files }}"

    - name: Hunt for suspicious cron jobs
      ansible.builtin.shell: |
        for user in $(cut -f1 -d: /etc/passwd); do
          crontab -l -u $user 2>/dev/null | grep -vE '^#|^$' | while read line; do
            echo "$user: $line"
          done
        done
      register: all_crons
      changed_when: false

    - name: Flag suspicious cron entries
      ansible.builtin.debug:
        msg: "⚠️ Suspicious cron: {{ item }}"
      loop: "{{ all_crons.stdout_lines }}"
      when: item is search('curl|wget|base64|eval|/tmp/')

- name: Preemptive auto-remediation
  hosts: all
  become: true
  tasks:
    - name: Disable unused services
      ansible.builtin.service:
        name: "{{ item }}"
        state: stopped
        enabled: false
      loop: "{{ unnecessary_services | default(['cups', 'avahi-daemon', 'rpcbind']) }}"
      ignore_errors: true

    - name: Harden SSH configuration
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
      loop:
        - { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
        - { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
        - { regexp: '^#?MaxAuthTries', line: 'MaxAuthTries 3' }
        - { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
        - { regexp: '^#?AllowTcpForwarding', line: 'AllowTcpForwarding no' }
      notify: Restart sshd

    - name: Set strict file permissions on sensitive files
      ansible.builtin.file:
        path: "{{ item }}"
        mode: "0600"
      loop:
        - /etc/shadow
        - /etc/gshadow
        - /etc/ssh/sshd_config

    - name: Configure automatic security updates
      ansible.builtin.template:
        src: unattended-upgrades.conf.j2
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
      when: ansible_os_family == "Debian"

    - name: Enable and configure auditd
      ansible.builtin.package:
        name: auditd
        state: present

    - name: Deploy audit rules
      ansible.builtin.copy:
        content: |
          -w /etc/passwd -p wa -k identity
          -w /etc/shadow -p wa -k identity
          -w /etc/sudoers -p wa -k sudoers
          -w /etc/ssh/sshd_config -p wa -k sshd
          -a always,exit -F arch=b64 -S execve -k exec
          -w /tmp -p x -k tmp_exec
        dest: /etc/audit/rules.d/preemptive.rules
      notify: Restart auditd

  handlers:
    - name: Restart sshd
      ansible.builtin.service:
        name: sshd
        state: restarted

    - name: Restart auditd
      ansible.builtin.service:
        name: auditd
        state: restarted

# Daily attack surface scan
ansible-playbook security/attack-surface.yml --tags scan

# Weekly threat hunting
ansible-playbook security/threat-hunt.yml

# Monthly full audit + remediation
ansible-playbook security/full-audit.yml --tags scan,hunt,remediate