Hardening a server fleet: Ansible, drift detection, compliance evidence
You bring dozens of servers to the same security baseline with Ansible, catch configuration drift and produce evidence an auditor can use, automatically.
Level 501 · 13 lessons · 15 practice labs
Lessons
The baseline as code
- Turning the baseline into code: one source of truth
- Writing a hardening role: SSH, sysctl, PAM
- Secrets in automation: Ansible Vault
- Measuring first with check mode and diff output
- Staged rollout: test group, canary, the whole fleet
- Short task: apply the role to three servers and show the second run changes nothing
Drift and exceptions
- Catching configuration drift with scheduled checks
- Keeping exceptions as data: expiry, owner, justification
- Folding emergency changes back into the baseline
- Short task: find two hand-edited servers and roll them back
Evidence and reporting
- Collecting OpenSCAP results across the fleet
- An evidence pack for the auditor: date, version, result
- Capstone: bring a 20-server fleet to the baseline and prove it
Practice labs
- Try the hardening role on one server in check mode: Run the role with --check --diff, list the settings that would change and confirm nothing changed.
- Make the role change nothing on its second run: Find the task that is not idempotent, fix it and show changed=0 on the second run.
- Move a plain password in the role into Ansible Vault: Encrypt the password in the vars file, run the role with the vault password and show no plain text is left in the repo.
- Catch an SSH setting that breaks on the canary server: Detect the setting that cuts access on the canary during a staged rollout, halt it, fix the role and retry.
- Find the hand-edited server in the drift report: Read the scheduled check output and identify the server that drifted from the baseline and the file that changed.
- Roll two drifted servers back to the baseline: Confirm the drifts, apply the role limited to those servers and show the next check comes back clean.
- Fold an emergency change permanently into the baseline: Add a firewall change made by hand during an incident to the role, close the exception and prove the fleet is consistent.
- Revert an expired exception automatically: Find the expired record in the exception data, reapply the baseline setting to that server and close the record.
- Collect and summarise OpenSCAP results across the fleet: Gather result files from every server and tabulate passed and failed rules per server.
- Find the single rule that drags compliance down: Find the rule that fails on the most servers, fix the root cause in the role and show the rate goes up.
- Prepare a tamper-evident evidence pack for the auditor: Package results with date and role version, sign their hashes and have the pack verified as unaltered.
- Sort the fleet’s servers into inventory groups by environment and role: Place ten unsorted servers into production, test and role groups in the Ansible inventory and show the hardening role runs on the test group only.
- List the failed rules from one server’s compliance report: Extract the failed rules with their severity from a ready OpenSCAP result file and save them as a short table.
- Match the evidence types an auditor wants to controls: Choose for eight controls whether config output, a scan report or a change record serves as evidence.
- Write an Ansible task that collects evidence from the fleet: Write a task that gathers SSH settings, password policy and the scan summary from every server into date-stamped files and records their hashes.
About this course
You bring dozens of servers to the same security baseline with Ansible, catch configuration drift and produce evidence an auditor can use, automatically.
What you will learn
- The baseline as code
- Drift and exceptions
- Evidence and reporting
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.