S

ssh-hardening

Ansible hardening for FreeBSD: SSH and 2FA, sshguard, CrowdSec, OpenBSM audit, AIDE, Lynis. Runs after ansible-base-freebsd, with an at(1) rollback to avoid lockouts.

Ansible hardening for Debian 13 hosts: SSH, CrowdSec/fail2ban, auditd/AIDE, sysctl, and PAM 2FA-- lockout-safe, runs after ansible-base-debian