deac
/
ansible-role-system
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

sshd-default.conf.j2 fixed {%%}; prefix ssh_ -> sshd_

master
Denis Knauf 2024-01-14 21:49:26 +01:00
parent cb299679bf
commit 857897eb39
3 changed files with 24 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
defaults/main.yml
View File

@ -1,9 +1,9 @@
has_hwrng: '{{ansible_virtualization_role != "guest" and ansible_local.devices.hwrng }}' has_hwrng: '{{ansible_virtualization_role != "guest" and ansible_local.devices.hwrng }}'
is_virt_guest: '{{ansible_virtualization_role == "guest"}}' is_virt_guest: '{{ansible_virtualization_role == "guest"}}'
is_container: '{{ansible_virtualization_role == "guest" and ansible_virtualization_type == "lxc"}}' is_container: '{{ansible_virtualization_role == "guest" and ansible_virtualization_type == "lxc"}}'
sys_default_users: [] sys_default_users: []
ssh_permit_root_login: 'prohibit-password' sshd_permit_root_login: 'prohibit-password'
ssh_ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com' sshd_ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
ssh_macs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' sshd_macs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
ssh_kex_algorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256' sshd_kex_algorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
ssh_host_keys: [/etc/ssh/ssh_host_ed25519_key, /etc/ssh/ssh_host_rsa_key] sshd_host_keys: [/etc/ssh/ssh_host_ed25519_key, /etc/ssh/ssh_host_rsa_key]

14
tasks/sshd_config.yml
View File

@ -18,16 +18,16 @@
regexp: '^\s*{{item.key}}\s' regexp: '^\s*{{item.key}}\s'
line: '{{item.key}} {{item.value}}' line: '{{item.key}} {{item.value}}'
with_dict: with_dict:
Port: '{{ssh_port|default(22)}}' Port: '{{sshd_port|default(22)}}'
PermitRootLogin: '{{ssh_permit_root_login}}' PermitRootLogin: '{{sshd_permit_root_login}}'
StrictModes: 'yes' StrictModes: 'yes'
PubkeyAuthentication: 'yes' PubkeyAuthentication: 'yes'
KerberosAuthentication: '{{ssh_kerberos_authentication|default(omit)}}' KerberosAuthentication: '{{sshd_kerberos_authentication|default(omit)}}'
GSSAPIAuthentication: '{{ssh_gssapi_authentication|default(omit)}}' GSSAPIAuthentication: '{{sshd_gssapi_authentication|default(omit)}}'
TCPKeepAlive: 'yes' TCPKeepAlive: 'yes'
Ciphers: '{{ssh_ciphers}}' Ciphers: '{{sshd_ciphers}}'
MACs: '{{ssh_macs}}' MACs: '{{sshd_macs}}'
KexAlgorithms: '{{ssh_kex_algorithms}}' KexAlgorithms: '{{sshd_kex_algorithms}}'
- name: sshd_config - name: sshd_config
lineinfile: lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config

16
templates/sshd-default.conf.j2
View File

@ -1,11 +1,11 @@
{{if ssh_port is defined }}Port {{ssh_port}}{{endif}} {%if sshd_port is defined %}Port {{sshd_port}}{%endif%}
PermitRootLogin {{ssh_permit_root_login}} PermitRootLogin {{sshd_permit_root_login}}
StrictModes yes StrictModes yes
PubkeyAuthentication yes PubkeyAuthentication yes
{{if ssh_kerberos_authentication is defined}}KerberosAuthentication {{ssh_kerberos_authentication}}{{endif}} {%if sshd_kerberos_authentication is defined%}KerberosAuthentication {{sshd_kerberos_authentication}}{%endif%}
{{if ssh_gssapi_authentication is defined}}GSSAPIAuthentication {{ssh_gssapi_authentication}}{{endif}} {%if sshd_gssapi_authentication is defined%}GSSAPIAuthentication {{sshd_gssapi_authentication}}{%endif%}
TCPKeepAlive yes TCPKeepAlive yes
Ciphers {{ssh_ciphers}} Ciphers {{sshd_ciphers}}
MACs {{ssh_macs}} MACs {{sshd_macs}}
KexAlgorithms {{ssh_kex_algorithms}} KexAlgorithms {{sshd_kex_algorithms}}
HostKey {%for k in ssh_host_keys%}{{k}}{%endfor%} HostKey {%for k in sshd_host_keys%}{{k}}{%endfor%}