deac/ansible-role-system
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

sshd_config: non-bookworm uses same vars like bookworm-default.conf.j2; &&/||->and/or

Browse source
This commit is contained in:
Denis Knauf 2024-01-14 21:05:02 +01:00
parent b14582103e
commit 31f431a7ec
1 changed files with 22 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
tasks/sshd_config.yml
View file

@ -1,7 +1,7 @@
--- ---
# vim: set expandtab tabstop=2 shiftwidth=2: # vim: set expandtab tabstop=2 shiftwidth=2:
- when: '"debian" == ansible_facts["os_family"]|lower && 12 <= ansible_facts["os_version_id"]' - when: '"debian" == ansible_facts["os_family"]|lower and 12 <= ansible_facts["os_version_id"]'
name: 'sshd_config.d/99-default.conf' name: 'sshd_config.d/99-default.conf'
template: template:
src: 'sshd-default.conf' src: 'sshd-default.conf'
@ -9,47 +9,47 @@
owner: root owner: root
group: root group: root
mode: 0644 mode: 0644
- when: '"debian" != ansible_facts["os_family"]|lower || 11 >= ansible_facts["os_version_id"]' - when: '"debian" != ansible_facts["os_family"]|lower or 11 >= ansible_facts["os_version_id"]'
block: block:
- name: sshd_config - name: sshd_config
lineinfile: lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
insertafter: '^\s*#\s*{{item.key}}\s+' insertafter: '^\s*#\s*{{item.key}}\s+'
regexp: '^\s*{{item.key}}\s' regexp: '^\s*{{item.key}}\s'
line: '{{item.key}} {{item.value}}' line: '{{item.key}} {{item.value}}'
with_dict: with_dict:
Port: '{{ssh_port|default(22)}}' Port: '{{ssh_port|default(22)}}'
PermitRootLogin: 'prohibit-password' PermitRootLogin: '{{ssh_permit_root_login}}'
StrictModes: 'yes' StrictModes: 'yes'
PubkeyAuthentication: 'yes' PubkeyAuthentication: 'yes'
KerberosAuthentication: 'no' KerberosAuthentication: '{{ssh_kerberos_authentication|default(omit)}}'
GSSAPIAuthentication: 'yes' GSSAPIAuthentication: '{{ssh_gssapi_authentication|default(omit)}}'
TCPKeepAlive: 'yes' TCPKeepAlive: 'yes'
Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com' Ciphers: '{{ssh_ciphers}}'
MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' MACs: '{{ssh_macs}}'
KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256' KexAlgorithms: '{{ssh_kex_algorithms}}'
- name: sshd_config - name: sshd_config
lineinfile: lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
insertbefore: '\s*#?\s*HostKey\s+' insertbefore: '\s*#?\s*HostKey\s+'
regexp: '^# HostKeys for protocol' regexp: '^# HostKeys for protocol'
line: '# HostKeys for protocol' line: '# HostKeys for protocol'
- name: sshd_config - prefer ed25519 - name: sshd_config - prefer ed25519
lineinfile: lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
insertafter: '^# HostKeys for protocol' insertafter: '^# HostKeys for protocol'
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$' regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
line: 'HostKey /etc/ssh/ssh_host_ed25519_key' line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
- name: sshd_config - fallback rsa - name: sshd_config - fallback rsa
lineinfile: lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$' insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$' regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
line: 'HostKey /etc/ssh/ssh_host_rsa_key' line: 'HostKey /etc/ssh/ssh_host_rsa_key'
- name: 'sshd_config - absent dsa / ecdsa' - name: 'sshd_config - absent dsa / ecdsa'
lineinfile: lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
state: absent state: absent
regexp: '{{item}}' regexp: '{{item}}'
with_list: with_list:
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$' - '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'