77 lines
2.9 KiB
YAML
77 lines
2.9 KiB
YAML
---
|
|
# vim: set expandtab tabstop=2 shiftwidth=2:
|
|
|
|
- name: 'check sshd include option'
|
|
command: 'sshd -o "include /dev/null"'
|
|
register: sshd_include_option_check
|
|
failed_when: 'sshd_include_option_check.rc not in [1,255] or sshd_include_option_check.stderr not in ["Include directive not supported as a command-line option", "command-line: line 0: Bad configuration option: include"]'
|
|
- set_fact:
|
|
sshd_include_option: '{{sshd_include_option_check.stderr == "Include directive not supported as a command-line option"}}'
|
|
- when: 'true == sshd_include_option'
|
|
block:
|
|
- name: '/etc/ssh/sshd_config.d'
|
|
file:
|
|
state: directory
|
|
path: '/etc/ssh/sshd_config.d'
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
- name: 'sshd_config.d/99-default.conf'
|
|
template:
|
|
src: 'sshd-default.conf.j2'
|
|
dest: '/etc/ssh/sshd_config.d/99-default.conf'
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
- lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertbefore: BOF
|
|
regexp: '^\s*include\s+/etc/ssh/sshd_config.d/'
|
|
line: 'include /etc/ssh/sshd_config.d/*.conf'
|
|
firstmatch: true
|
|
- when: 'false == sshd_include_option'
|
|
block:
|
|
- name: sshd_config
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertafter: '^\s*#\s*{{item.key}}\s+'
|
|
regexp: '^\s*{{item.key}}\s'
|
|
line: '{{item.key}} {{item.value}}'
|
|
with_dict:
|
|
Port: '{{sshd_port|default(22)}}'
|
|
PermitRootLogin: '{{sshd_permit_root_login}}'
|
|
StrictModes: 'yes'
|
|
PubkeyAuthentication: 'yes'
|
|
KerberosAuthentication: '{{sshd_kerberos_authentication}}'
|
|
GSSAPIAuthentication: '{{sshd_gssapi_authentication}}'
|
|
TCPKeepAlive: 'yes'
|
|
Ciphers: '{{sshd_ciphers}}'
|
|
MACs: '{{sshd_macs}}'
|
|
KexAlgorithms: '{{sshd_kex_algorithms}}'
|
|
- name: sshd_config
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertbefore: '\s*#?\s*HostKey\s+'
|
|
regexp: '^# HostKeys for protocol'
|
|
line: '# HostKeys for protocol'
|
|
- name: sshd_config - prefer ed25519
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertafter: '^# HostKeys for protocol'
|
|
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
|
line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
|
|
- name: sshd_config - fallback rsa
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
|
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
|
|
line: 'HostKey /etc/ssh/ssh_host_rsa_key'
|
|
- name: 'sshd_config - absent dsa / ecdsa'
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
state: absent
|
|
regexp: '{{item}}'
|
|
with_list:
|
|
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
|
|
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'
|