deac/ansible-role-system
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

sshd-config: for debian-12: config in /etc/ssh/sshd_config.d/default.conf

Browse source
This commit is contained in:
Denis Knauf 2024-01-14 13:13:57 +01:00
parent 2ff87d6f68
commit b14582103e
3 changed files with 73 additions and 47 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
defaults/main.yml
View file

@ -1,4 +1,9 @@
has_hwrng: '{{ansible_virtualization_role != "guest" and ansible_local.devices.hwrng }}' has_hwrng: '{{ansible_virtualization_role != "guest" and ansible_local.devices.hwrng }}'
is_virt_guest: '{{ansible_virtualization_role == "guest"}}' is_virt_guest: '{{ansible_virtualization_role == "guest"}}'
is_container: '{{ansible_virtualization_role == "guest" and ansible_virtualization_type == "lxc"}}' is_container: '{{ansible_virtualization_role == "guest" and ansible_virtualization_type == "lxc"}}'
sys_default_users: [] sys_default_users: []
ssh_permit_root_login: 'prohibit-password'
ssh_ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
ssh_macs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
ssh_kex_algorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
ssh_host_keys: [/etc/ssh/ssh_host_ed25519_key, /etc/ssh/ssh_host_rsa_key]

96
tasks/sshd_config.yml
View file

@ -1,46 +1,56 @@
--- ---
# vim: set expandtab tabstop=2 shiftwidth=2: # vim: set expandtab tabstop=2 shiftwidth=2:
- name: sshd_config - when: '"debian" == ansible_facts["os_family"]|lower && 12 <= ansible_facts["os_version_id"]'
lineinfile: name: 'sshd_config.d/99-default.conf'
path: /etc/ssh/sshd_config template:
insertafter: '^\s*#\s*{{item.key}}\s+' src: 'sshd-default.conf'
regexp: '^\s*{{item.key}}\s' dest: '/etc/ssh/sshd_config.d/99-default.conf'
line: '{{item.key}} {{item.value}}' owner: root
with_dict: group: root
Port: '{{ssh_port|default(22)}}' mode: 0644
PermitRootLogin: 'prohibit-password' - when: '"debian" != ansible_facts["os_family"]|lower || 11 >= ansible_facts["os_version_id"]'
StrictModes: 'yes' block:
PubkeyAuthentication: 'yes' - name: sshd_config
KerberosAuthentication: 'no' lineinfile:
GSSAPIAuthentication: 'yes' path: /etc/ssh/sshd_config
TCPKeepAlive: 'yes' insertafter: '^\s*#\s*{{item.key}}\s+'
Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com' regexp: '^\s*{{item.key}}\s'
MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' line: '{{item.key}} {{item.value}}'
KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256' with_dict:
- name: sshd_config Port: '{{ssh_port|default(22)}}'
lineinfile: PermitRootLogin: 'prohibit-password'
path: /etc/ssh/sshd_config StrictModes: 'yes'
insertbefore: '\s*#?\s*HostKey\s+' PubkeyAuthentication: 'yes'
regexp: '^# HostKeys for protocol' KerberosAuthentication: 'no'
line: '# HostKeys for protocol' GSSAPIAuthentication: 'yes'
- name: sshd_config - prefer ed25519 TCPKeepAlive: 'yes'
lineinfile: Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
path: /etc/ssh/sshd_config MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
insertafter: '^# HostKeys for protocol' KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$' - name: sshd_config
line: 'HostKey /etc/ssh/ssh_host_ed25519_key' lineinfile:
- name: sshd_config - fallback rsa path: /etc/ssh/sshd_config
lineinfile: insertbefore: '\s*#?\s*HostKey\s+'
path: /etc/ssh/sshd_config regexp: '^# HostKeys for protocol'
insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$' line: '# HostKeys for protocol'
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$' - name: sshd_config - prefer ed25519
line: 'HostKey /etc/ssh/ssh_host_rsa_key' lineinfile:
- name: 'sshd_config - absent dsa / ecdsa' path: /etc/ssh/sshd_config
lineinfile: insertafter: '^# HostKeys for protocol'
path: /etc/ssh/sshd_config regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
state: absent line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
regexp: '{{item}}' - name: sshd_config - fallback rsa
with_list: lineinfile:
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$' path: /etc/ssh/sshd_config
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$' insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
line: 'HostKey /etc/ssh/ssh_host_rsa_key'
- name: 'sshd_config - absent dsa / ecdsa'
lineinfile:
path: /etc/ssh/sshd_config
state: absent
regexp: '{{item}}'
with_list:
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'

11
templates/sshd-default.conf.j2 Normal file
View file

@ -0,0 +1,11 @@
{{if ssh_port is defined }}Port {{ssh_port}}{{endif}}
PermitRootLogin {{ssh_permit_root_login}}
StrictModes yes
PubkeyAuthentication yes
{{if ssh_kerberos_authentication is defined}}KerberosAuthentication {{ssh_kerberos_authentication}}{{endif}}
{{if ssh_gssapi_authentication is defined}}GSSAPIAuthentication {{ssh_gssapi_authentication}}{{endif}}
TCPKeepAlive yes
Ciphers {{ssh_ciphers}}
MACs {{ssh_macs}}
KexAlgorithms {{ssh_kex_algorithms}}
HostKey {%for k in ssh_host_keys%}{{k}}{%endfor%}