Lion Cipher Lab
Harden a Linux server with an Ansible role (an idempotent CIS-style baseline) — automation, Part 2
- Cyber / Security Engineer
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Clicking through the same twenty hardening steps on every new server is slow, error-prone, and impossible to audit. A hardening role turns "secure this box" into one repeatable, reviewable file you can run on one server or a thousand, prove is applied, and re-run any time to catch drift. This is config-as-code — the same skill that underpins real infrastructure, compliance evidence, and blue-team baselines.
What you'll learn
- Writing an Ansible role (tasks, handlers, defaults)
- SSH and OS hardening basics
- Idempotence — the config-as-code mindset
- Linting playbooks with ansible-lint
- Judging when to reuse a vetted galaxy collection vs hand-rolling
Steps in this lab
- The words you need, defined once
- Why a role beats a bash script (the judgment)
- Pick and reach a target box
- Scaffold the role
- Write the SSH-hardening tasks
- Write a playbook that applies the role, and run it
- Prove idempotence — run it again
- Lint the role with ansible-lint
- When NOT to hand-roll: don't reinvent the CIS baseline
- What you built — and where it goes