57 lines
2.2 KiB
YAML
57 lines
2.2 KiB
YAML
---
|
|
# vim: set expandtab tabstop=2 shiftwidth=2:
|
|
|
|
- when: '"debian" == ansible_facts["distribution"]|lower and 12 <= ansible_facts["distribution_version"]|int'
|
|
name: 'sshd_config.d/99-default.conf'
|
|
template:
|
|
src: 'sshd-default.conf'
|
|
dest: '/etc/ssh/sshd_config.d/99-default.conf'
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
- when: '"debian" != ansible_facts["distribution"]|lower or 11 >= ansible_facts["distribution_version"]|int'
|
|
block:
|
|
- name: sshd_config
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertafter: '^\s*#\s*{{item.key}}\s+'
|
|
regexp: '^\s*{{item.key}}\s'
|
|
line: '{{item.key}} {{item.value}}'
|
|
with_dict:
|
|
Port: '{{ssh_port|default(22)}}'
|
|
PermitRootLogin: '{{ssh_permit_root_login}}'
|
|
StrictModes: 'yes'
|
|
PubkeyAuthentication: 'yes'
|
|
KerberosAuthentication: '{{ssh_kerberos_authentication|default(omit)}}'
|
|
GSSAPIAuthentication: '{{ssh_gssapi_authentication|default(omit)}}'
|
|
TCPKeepAlive: 'yes'
|
|
Ciphers: '{{ssh_ciphers}}'
|
|
MACs: '{{ssh_macs}}'
|
|
KexAlgorithms: '{{ssh_kex_algorithms}}'
|
|
- name: sshd_config
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertbefore: '\s*#?\s*HostKey\s+'
|
|
regexp: '^# HostKeys for protocol'
|
|
line: '# HostKeys for protocol'
|
|
- name: sshd_config - prefer ed25519
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertafter: '^# HostKeys for protocol'
|
|
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
|
line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
|
|
- name: sshd_config - fallback rsa
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
|
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
|
|
line: 'HostKey /etc/ssh/ssh_host_rsa_key'
|
|
- name: 'sshd_config - absent dsa / ecdsa'
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
state: absent
|
|
regexp: '{{item}}'
|
|
with_list:
|
|
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
|
|
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'
|