2021-04-10 22:11:19 +02:00
---
# vim: set expandtab tabstop=2 shiftwidth=2:
2024-01-14 22:32:35 +01:00
- name : 'check sshd include option'
command : 'sshd -o "include /dev/null"'
register : sshd_include_option_check
failed_when : 'sshd_include_option_check.rc not in [1,255] or sshd_include_option_check.stderr not in ["Include directive not supported as a command-line option", "command-line: line 0: Bad configuration option: include"]'
2024-01-14 22:50:16 +01:00
- set_fact :
sshd_include_option : '{{sshd_include_option_check.stderr == "Include directive not supported as a command-line option"}}'
2024-01-14 22:32:35 +01:00
- when : 'true == sshd_include_option'
block :
- name : '/etc/ssh/sshd_config.d'
file :
2024-01-14 22:53:43 +01:00
state : directory
path : '/etc/ssh/sshd_config.d'
2024-01-14 22:32:35 +01:00
owner : root
group : root
mode : 0644
- name : 'sshd_config.d/99-default.conf'
template :
src : 'sshd-default.conf.j2'
dest : '/etc/ssh/sshd_config.d/99-default.conf'
owner : root
group : root
mode : 0644
- lineinfile :
path : /etc/ssh/sshd_config
insertbefore : BOF
regexp : '^\s*include\s+/etc/ssh/sshd_config.d/'
line : 'include /etc/ssh/sshd_config.d/*.conf'
firstmatch : true
- when : 'false == sshd_include_option'
2024-01-14 13:13:57 +01:00
block :
- name : sshd_config
lineinfile :
2024-01-14 21:05:02 +01:00
path : /etc/ssh/sshd_config
2024-01-14 13:13:57 +01:00
insertafter : '^\s*#\s*{{item.key}}\s+'
2024-01-14 21:05:02 +01:00
regexp : '^\s*{{item.key}}\s'
line : '{{item.key}} {{item.value}}'
2024-01-14 13:13:57 +01:00
with_dict :
2024-01-14 21:49:26 +01:00
Port : '{{sshd_port|default(22)}}'
PermitRootLogin : '{{sshd_permit_root_login}}'
2024-01-14 13:13:57 +01:00
StrictModes : 'yes'
PubkeyAuthentication : 'yes'
2024-01-14 23:23:27 +01:00
KerberosAuthentication : '{{sshd_kerberos_authentication}}'
GSSAPIAuthentication : '{{sshd_gssapi_authentication}}'
2024-01-14 13:13:57 +01:00
TCPKeepAlive : 'yes'
2024-03-24 22:23:27 +01:00
#Ciphers: '{{sshd_ciphers}}'
#MACs: '{{sshd_macs}}'
#KexAlgorithms: '{{sshd_kex_algorithms}}'
2024-01-14 13:13:57 +01:00
- name : sshd_config
lineinfile :
2024-01-14 21:05:02 +01:00
path : /etc/ssh/sshd_config
2024-01-14 13:13:57 +01:00
insertbefore : '\s*#?\s*HostKey\s+'
2024-01-14 21:05:02 +01:00
regexp : '^# HostKeys for protocol'
line : '# HostKeys for protocol'
2024-01-14 13:13:57 +01:00
- name : sshd_config - prefer ed25519
lineinfile :
2024-01-14 21:05:02 +01:00
path : /etc/ssh/sshd_config
2024-01-14 13:13:57 +01:00
insertafter : '^# HostKeys for protocol'
2024-01-14 21:05:02 +01:00
regexp : '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
line : 'HostKey /etc/ssh/ssh_host_ed25519_key'
2024-01-14 13:13:57 +01:00
- name : sshd_config - fallback rsa
lineinfile :
2024-01-14 21:05:02 +01:00
path : /etc/ssh/sshd_config
2024-01-14 13:13:57 +01:00
insertafter : '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
2024-01-14 21:05:02 +01:00
regexp : '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
line : 'HostKey /etc/ssh/ssh_host_rsa_key'
2024-01-14 13:13:57 +01:00
- name : 'sshd_config - absent dsa / ecdsa'
lineinfile :
2024-01-14 21:05:02 +01:00
path : /etc/ssh/sshd_config
state : absent
2024-01-14 13:13:57 +01:00
regexp : '{{item}}'
with_list :
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'