ansible-collection-hardening VS netboot.xyz

An ansible collection for hardening Linux systems I mostly wrote: https://github.com/dev-sec/ansible-collection-hardening

Another ansible collection to manage Icinga: https://github.com/T-Systems-MMS/ansible-collection-icinga-d...

And the yunohost app for invoice ninja: https://github.com/YunoHost-Apps/invoiceninja5_ynh

This collection is also interesting https://github.com/dev-sec/ansible-collection-hardening/

To ensure SSH and other security related things are configured correctly, you can take a look at DevSec which helps you to apply proven security configuration principles. Also there is guides like "Secure Secure Shell" which can help you to better understand what you can do to increase the security of your servers (this one is from 2015 but many aspects are still relevant).

I learned a lot by using and reading through the source code of these ansible roles: https://github.com/dev-sec/ansible-collection-hardening

You can do much more https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/ssh_hardening

In the past, I have used the inspec part of : https://dev-sec.io

There’s Dev-Sec which is more about multi-OS-platform as well as multi-IaS (Ansible, Puppet, Chef).

Free, to boot.

https://github.com/dev-sec/ansible-collection-hardening

It's one of the most secure services to expose over the Internet (assuming you've setup key-based authentication - and some additional measures like restricting SSH access to a group. You can harden it a lot more)

I replied to a reply of yours with this same info, but since you’re both sorta asking the same thing, I’ll post it here for you also.

https://netboot.xyz/

https://github.com/netbootxyz/netboot.xyz

This might do what you are thinking, and does use iPXE under the hood.

https://netboot.xyz/

Knew about http://netboot.xyz, but had no idea iVentoy existed. Good to know.

Firstly, downloading and managing FCOS ISOs is going to cause you too much trouble. There's a new release of FCOS every 2 weeks plus patches in between and you'll never be able to keep up, so don't use these. Instead, what I do is network booting for installations using NetBoot.xyz, which pulls the installation image from the internet every time. This allows me to not only use the latest FCOS image every time I add a new machine, but also to streamline the Ignition config into the install at the same time.

Hey thanks for the detailed response. You're saying you boot FCOS on bare metal over PXE, correct? I've thought about trying that approach, but have little experience with PXE and TFTP. I just checked out netboot.xyz and it looks surprisingly easy to get going. Last time I played around with PXE I used Synology's TFTP server and, while I got it working, I was more confused by the end than when I started. I think actually learning PXE end-to-end and understanding what I am doing there would be a solid foundation for building my environment the right way.

For netbooting we rely on a netboot.xyz inspired ipxe based setup.

I tried netboot.xyz but their IPv6 support in 2023 is still broken...

https://github.com/netbootxyz/netboot.xyz/issues/283

Let's try this one.

I have found netboot.xyz but havent got time still to try it. is this something that can be done with netboot.xyz?