config_combo2.yml

#Cisco IOS 12.2 Hardening Playbook
#
#+ no service pad
#+ ip ssh version 2
#+ no ip domain-lookup
#+ no ip http server
#+ no ip http secure-server
#+ no cdp run
#+ transport input ssh
#+ logging buffered 15000
#+ service password-encryption


- hosts: ios
  gather_facts: no
  connection: local

  tasks:
  - name: OBTAIN LOGIN CREDENTIALS
    include_vars: secrets.yaml

  - name: DEFINE PROVIDER
    set_fact:
      provider:
        host: "{{ inventory_hostname }}"
        username: "{{ creds['username'] }}"
        password: "{{ creds['password'] }}"
        auth_pass: "{{ creds['auth_pass'] }}"

  - name: SHOW RUN | BEG VTY
    ios_command:
      provider: "{{ provider }}"
      authorize: yes
      commands:
        - show run | beg vty
    register: before_vty
 
  - debug: var=before_vty.stdout_lines
 
  - name: NO SERVICE PAD
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - no service pad

  - name: IP SSH VERSION 2
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - ip ssh version 2

  - name: NO IP DOMAIN-LOOKUP
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - no ip domain-lookup

  - name: DISABLE HTTP/HTTPS MANAGMENT
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - no ip http server
        - no ip http secure-server

  - name: DISABLE CDP 
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - no cdp run

  - name: TRANSPORT INPUT SSH
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - line vty 0 15
        - transport input ssh

  - name: LOGGING BUFFERED 15000
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - logging buffered 15000

  - name: SERVICE PASSWORD ENCRYPTION
    ios_config:
      provider: "{{ provider }}"
      authorize: yes
      lines:
        - service password-encryption
        
  - name: SHOW RUN | BEG VTY
    ios_command:
      provider: "{{ provider }}"
      authorize: yes
      commands:
        - show run | beg vty
    register: after_vty
 
  - debug: var=after_vty.stdout_lines