10 files changed, 189 insertions, 0 deletions
diff --git a/roles/ssh/README.md b/roles/ssh/README.md
new file mode 100644
index 00000000..7786808a
--- /dev/null
+++ b/roles/ssh/README.md
@@ -0,0 +1,23 @@
+# Ansible Role: ssh
+
+This role configure the ssh functionality of a linux distro with hardening
+
+## Role Variables
+
+- `username` the user account to be added to the ssh allowed users.
+- `ssh_port` the port number to be enabled for ssh (default: 2222)
+
+## Internals
+
+- ensure that ssh packages is installed and enabled
+- configure ssh host keys
+- configure ssh defaults
+  - disable keyboard interactive authentication
+  - disable PAM authentication
+- configure ssh authentication policy (hardened)
+  - configure custom ssh port
+  - disable password authentication
+  - require public key authentication
+  - disable root login
+- add user (username) to allowed authentication users
+- TBA: `fail2ban`
diff --git a/roles/ssh/defaults/main.yml b/roles/ssh/defaults/main.yml
new file mode 100644
index 00000000..a3f3e329
--- /dev/null
+++ b/roles/ssh/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+ssh_port: 2222
diff --git a/roles/ssh/handlers/main.yml b/roles/ssh/handlers/main.yml
new file mode 100644
index 00000000..a73aca7e
--- /dev/null
+++ b/roles/ssh/handlers/main.yml
@@ -0,0 +1,13 @@
+---
+- name: "Reload systemd"
+  become: true
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: not ansible_is_chroot
+
+- name: "Restart ssh"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "{{ ssh_service_name }}"
+    state: "restarted"
+  when: not ansible_is_chroot
diff --git a/roles/ssh/meta/argument_specs.yml b/roles/ssh/meta/argument_specs.yml
new file mode 100644
index 00000000..ec1a6942
--- /dev/null
+++ b/roles/ssh/meta/argument_specs.yml
@@ -0,0 +1,13 @@
+---
+argument_specs:
+  main:
+    options:
+      username:
+        type: "str"
+        required: true
+        description: "The username of the account to add to ssh."
+      ssh_port:
+        type: "int"
+        required: false
+        default: 2222
+        description: "The default ssh port configuration (to avoid port 22 pwn/testing)"
diff --git a/roles/ssh/meta/main.yml b/roles/ssh/meta/main.yml
new file mode 100644
index 00000000..c4eeebec
--- /dev/null
+++ b/roles/ssh/meta/main.yml
@@ -0,0 +1,16 @@
+---
+dependencies: []
+galaxy_info:
+  role_name: ssh
+  author: a14m
+  description: "Configure distro ssh with hardening"
+  company: "kartoffeln.work GmbH."
+  license: "license MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: ArchLinux
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - noble
diff --git a/roles/ssh/tasks/install-archlinux.yml b/roles/ssh/tasks/install-archlinux.yml
new file mode 100644
index 00000000..2b24a346
--- /dev/null
+++ b/roles/ssh/tasks/install-archlinux.yml
@@ -0,0 +1,7 @@
+---
+- name: "Ensure sshd installed"
+  become: true
+  community.general.pacman:
+    name: "{{ ssh_package_name }}"
+    state: present
+  tags: [required_for_boot]
diff --git a/roles/ssh/tasks/install-debian.yml b/roles/ssh/tasks/install-debian.yml
new file mode 100644
index 00000000..c482ce74
--- /dev/null
+++ b/roles/ssh/tasks/install-debian.yml
@@ -0,0 +1,7 @@
+---
+- name: "Ensure ssh installed"
+  become: true
+  ansible.builtin.apt:
+    name: "{{ ssh_package_name }}"
+    state: "present"
+  tags: [required_for_boot]
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
new file mode 100644
index 00000000..91ea250f
--- /dev/null
+++ b/roles/ssh/tasks/main.yml
@@ -0,0 +1,102 @@
+---
+- name: "Include OS-specific variables"
+  ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
+  tags: [required_for_boot]
+
+- name: "Install OS-specific packages"
+  ansible.builtin.include_tasks: "install-{{ ansible_os_family | lower }}.yml"
+  tags: [required_for_boot]
+
+- name: "Ensure ssh_service is enabled"
+  become: true
+  ansible.builtin.service:
+    name: "{{ ssh_service_name }}"
+    state: "started"
+    enabled: true
+  when: not ansible_is_chroot
+  tags: [required_for_boot]
+
+- name: "(chroot): Ensure ssh_service enabled"
+  # noqa: command-instead-of-module intentional isnide chroot
+  ansible.builtin.command:
+    cmd: "systemctl enable {{ ssh_service_name }}"
+  when: ansible_is_chroot
+  changed_when: true
+  tags: [required_for_boot]
+
+- name: "Generate /etc/ssh/ RSA host key"
+  become: true
+  ansible.builtin.command:
+    cmd: "ssh-keygen -q -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C '' -N ''"
+    creates: "/etc/ssh/ssh_host_rsa_key"
+  tags: [required_for_boot]
+
+- name: "Generate /etc/ssh/ ECDSA host key"
+  become: true
+  ansible.builtin.command:
+    cmd: "ssh-keygen -q -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -C '' -N ''"
+    creates: "/etc/ssh/ssh_host_ecdsa_key"
+  tags: [required_for_boot]
+
+- name: "Generate /etc/ssh/ Ed25519 host key"
+  become: true
+  ansible.builtin.command:
+    cmd: "ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C '' -N ''"
+    creates: "/etc/ssh/ssh_host_ed25519_key"
+  tags: [required_for_boot]
+
+- name: "Configure sshd_config"
+  become: true
+  ansible.builtin.copy:
+    dest: "/etc/ssh/sshd_config"
+    mode: "0640"
+    validate: 'sshd -T -f %s'
+    content: |
+      KbdInteractiveAuthentication no   # default installation is no
+      UsePAM no                         # default installation is yes
+      PrintMotd yes                     # default installation is no
+
+      # Host key configurations
+      HostKey /etc/ssh/ssh_host_rsa_key
+      HostKey /etc/ssh/ssh_host_ecdsa_key
+      HostKey /etc/ssh/ssh_host_ed25519_key
+
+      # Default sshd_config
+      AuthorizedKeysFile    .ssh/authorized_keys
+      Subsystem     sftp    /usr/lib/ssh/sftp-server
+      Include /etc/ssh/sshd_config.d/*.conf
+  notify:
+    - "Reload systemd"
+    - "Restart ssh"
+  tags: [required_for_boot]
+
+- name: "Configure ssh authentication policy"
+  become: true
+  ansible.builtin.copy:
+    dest: "/etc/ssh/sshd_config.d/99-auth-policy.conf"
+    mode: "0640"
+    validate: 'sshd -T -f %s'
+    content: |
+      Port {{ ssh_port }}
+      PasswordAuthentication no
+      AuthenticationMethods publickey
+      PermitRootLogin no
+      PermitEmptyPasswords no
+      ChallengeResponseAuthentication no
+      GSSAPIAuthentication no
+      X11Forwarding no
+  notify:
+    - "Restart ssh"
+  tags: [required_for_boot]
+
+- name: "Add arg.username to allowed users"
+  become: true
+  ansible.builtin.copy:
+    dest: "/etc/ssh/sshd_config.d/99-allowed-users.conf"
+    mode: "0640"
+    validate: 'sshd -T -f %s'
+    content: |
+      AllowUsers {{ username }}
+  notify:
+    - "Restart ssh"
+  tags: [required_for_boot]
diff --git a/roles/ssh/vars/archlinux.yml b/roles/ssh/vars/archlinux.yml
new file mode 100644
index 00000000..98fa3cc2
--- /dev/null
+++ b/roles/ssh/vars/archlinux.yml
@@ -0,0 +1,3 @@
+---
+ssh_package_name: "openssh"
+ssh_service_name: "sshd"
diff --git a/roles/ssh/vars/debian.yml b/roles/ssh/vars/debian.yml
new file mode 100644
index 00000000..617aaac9
--- /dev/null
+++ b/roles/ssh/vars/debian.yml
@@ -0,0 +1,3 @@
+---
+ssh_package_name: "openssh-server"
+ssh_service_name: "ssh"