Automate Server Hardening with Ansible and CIS Benchmarks

Keeping Linux servers secure becomes much easier when security settings are applied automatically. Instead of logging in to every server and making manual changes, Ansible allows you to apply the same security configuration across your entire infrastructure in a few minutes.

In this tutorial, you will use the latest devsec.hardening Ansible collection to apply security settings that closely follow the CIS Benchmarks for Ubuntu 26.04. The collection is actively maintained and supports Ubuntu 26.04 with Ansible 2.16 or later.

Prerequisites

Ubuntu 26.04 server control machine
One or more Ubuntu 26.04 servers
SSH access with sudo privileges
Python 3 installed on the target servers

Step 1: Install Ansible

Update your package index.

sudo apt update

Install Ansible.

sudo apt install ansible -y

Verify the installation.

ansible --version

You should see Ansible Core 2.16 or newer.

Step 2: Test SSH Connectivity

Confirm that Ansible can connect to your server.

ssh user@your-server-ip

Replace the following values.

user with your SSH username
your-server-ip with your server IP address

Exit the session.

exit

Step 3: Create a Project Directory

Create a working directory.

mkdir ansible-hardening

Move into it.

cd ansible-hardening

Step 4: Create an Inventory File

Create a file named inventory.ini.

nano inventory.ini

Example configuration.

[servers]
server1 ansible_host=192.168.1.100 ansible_user=ubuntu
server2 ansible_host=192.168.1.101 ansible_user=ubuntu

Save the file.

Test connectivity.

ansible all -i inventory.ini -m ping

Expected output.

server1 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

Step 5: Install the DevSec Hardening Collection

Install the latest collection from Ansible Galaxy.

ansible-galaxy collection install devsec.hardening

Verify that it is installed.

ansible-galaxy collection list

You should see.

devsec.hardening

The collection includes operating system, SSH, Nginx and MySQL hardening roles and supports Ubuntu 26.04.

Step 6: Create the Playbook

Create a file named harden.yml.

nano harden.yml

Paste the following configuration.

---
- name: Apply CIS style server hardening
  hosts: servers
  become: true

  roles:
    - devsec.hardening.os_hardening
    - devsec.hardening.ssh_hardening

Save the file.

This playbook applies the following security settings.

Operating system security settings
SSH security improvements

Step 7: Review Default Settings

Every environment is different. Before applying security settings to production, review the available variables.

Create a variables directory.

mkdir group_vars

Create the variables file.

nano group_vars/all.yml

Example configuration.

ssh_allow_users:
  - ubuntu

sysctl_overwrite:
  net.ipv4.ip_forward: 0

Only include settings that match your environment.

Step 8: Run a Dry Run

A dry run shows what Ansible plans to change without modifying the server.

ansible-playbook -i inventory.ini harden.yml --check

Review the output carefully.

Step 9: Apply the Hardening

Run the playbook.

ansible-playbook -i inventory.ini harden.yml

Example output.

PLAY RECAP

server1
ok=48
changed=12
failed=0

server2
ok=48
changed=12
failed=0

Your servers now share the same security configuration.

Step 10: Verify SSH Access

Open a new terminal and connect again.

ssh ubuntu@your-server-ip

Always confirm SSH access before closing your current session.

Step 11: Check SSH Configuration

View important SSH settings.

sudo sshd -T

You can review settings such as:

Password authentication
Root login
Authentication methods
Ciphers
MAC algorithms

Step 12: Check Firewall Status

If your environment uses UFW, verify that it is active.

sudo ufw status

Step 13: Verify Important Security Settings

Check password policies.

sudo cat /etc/login.defs

View mounted file systems.

mount

Check kernel security parameters.

sysctl -a

View active services.

systemctl list-units --type=service --state=running

Step 14: Run the Playbook Again

Run the playbook one more time.

ansible-playbook -i inventory.ini harden.yml

A well written Ansible playbook is idempotent. Running it again only changes settings when they no longer match the desired configuration.

Directory Structure

Your project should look like this.

ansible-hardening/
├── inventory.ini
├── harden.yml
└── group_vars
    └── all.yml

Benefits of Using Ansible for Server Hardening

Apply the same security settings to every server
Reduce manual configuration work
Keep deployments consistent
Save time during server provisioning
Easily repeat the process whenever new servers are added
Version control your infrastructure

Tips for Production Environments

Test changes on a staging server first.
Keep SSH access open while validating new settings.
Store playbooks in Git.
Review collection variables before enabling additional restrictions.
Apply hardening as part of your server provisioning workflow.
Schedule regular compliance reviews against the latest CIS Benchmarks as recommendations evolve.

Conclusion

In this tutorial, we have learned how to automate Ubuntu 26.04 server hardening with Ansible and CIS Benchmarks.

Ansible makes server hardening simple, repeatable and consistent. By combining Ansible with the DevSec Hardening collection, you can apply security settings based on CIS guidance across one server or hundreds of servers using the same playbook. As your infrastructure grows, this approach helps keep every system configured in a consistent and predictable way without repeating the same manual steps.