ansible-role-system/tasks/sshd_config.yml

57 lines
2.2 KiB
YAML
Raw Normal View History

2021-04-10 22:11:19 +02:00
---
# vim: set expandtab tabstop=2 shiftwidth=2:
2024-01-14 21:35:06 +01:00
- when: '"debian" == ansible_facts["distribution"]|lower and 12 <= ansible_facts["distribution_version"]|int'
name: 'sshd_config.d/99-default.conf'
template:
2024-01-14 21:38:50 +01:00
src: 'sshd-default.conf.j2'
dest: '/etc/ssh/sshd_config.d/99-default.conf'
owner: root
group: root
mode: 0644
2024-01-14 21:35:06 +01:00
- when: '"debian" != ansible_facts["distribution"]|lower or 11 >= ansible_facts["distribution_version"]|int'
block:
- name: sshd_config
lineinfile:
path: /etc/ssh/sshd_config
insertafter: '^\s*#\s*{{item.key}}\s+'
regexp: '^\s*{{item.key}}\s'
line: '{{item.key}} {{item.value}}'
with_dict:
Port: '{{sshd_port|default(22)}}'
PermitRootLogin: '{{sshd_permit_root_login}}'
StrictModes: 'yes'
PubkeyAuthentication: 'yes'
KerberosAuthentication: '{{sshd_kerberos_authentication|default(omit)}}'
GSSAPIAuthentication: '{{sshd_gssapi_authentication|default(omit)}}'
TCPKeepAlive: 'yes'
Ciphers: '{{sshd_ciphers}}'
MACs: '{{sshd_macs}}'
KexAlgorithms: '{{sshd_kex_algorithms}}'
- name: sshd_config
lineinfile:
path: /etc/ssh/sshd_config
insertbefore: '\s*#?\s*HostKey\s+'
regexp: '^# HostKeys for protocol'
line: '# HostKeys for protocol'
- name: sshd_config - prefer ed25519
lineinfile:
path: /etc/ssh/sshd_config
insertafter: '^# HostKeys for protocol'
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
- name: sshd_config - fallback rsa
lineinfile:
path: /etc/ssh/sshd_config
insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
line: 'HostKey /etc/ssh/ssh_host_rsa_key'
- name: 'sshd_config - absent dsa / ecdsa'
lineinfile:
path: /etc/ssh/sshd_config
state: absent
regexp: '{{item}}'
with_list:
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'