blob: 7df9efe8295b7add0aa1d65963ba5a7e1d8c00e7 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
---
- name: "Include OS-specific variables"
ansible.builtin.include_vars: "{{ ansible_facts['os_family'] | lower }}.yml"
- name: "Ensure ssh package is installed"
become: true
ansible.builtin.package:
name: "{{ ssh_package }}"
state: "present"
- name: "Generate /etc/ssh/ RSA host key"
become: true
ansible.builtin.command:
cmd: "ssh-keygen -q -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C '' -N ''"
creates: "/etc/ssh/ssh_host_rsa_key"
- name: "Generate /etc/ssh/ ECDSA host key"
become: true
ansible.builtin.command:
cmd: "ssh-keygen -q -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -C '' -N ''"
creates: "/etc/ssh/ssh_host_ecdsa_key"
- name: "Generate /etc/ssh/ Ed25519 host key"
become: true
ansible.builtin.command:
cmd: "ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C '' -N ''"
creates: "/etc/ssh/ssh_host_ed25519_key"
- name: "Ensure ssh service is enabled"
become: true
ansible.builtin.service:
name: "{{ ssh_service }}"
state: "started"
enabled: true
when: not ansible_facts['is_chroot']
- name: "(chroot): Ensure ssh service is enabled"
# noqa: command-instead-of-module intentional isnide chroot
ansible.builtin.command:
cmd: "systemctl enable {{ ssh_service }}"
when: ansible_facts['is_chroot']
changed_when: true
- name: "Configure sshd_config"
become: true
ansible.builtin.copy:
dest: "/etc/ssh/sshd_config"
mode: "0640"
validate: "{{ 'sshd -T -f %s' if (not ansible_facts['is_chroot']) else omit }}"
content: |
KbdInteractiveAuthentication no # default installation is no
UsePAM no # default installation is yes
PrintMotd yes # default installation is no
# Host key configurations
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
# Default sshd_config
AuthorizedKeysFile .ssh/authorized_keys
Subsystem sftp /usr/lib/ssh/sftp-server
Include /etc/ssh/sshd_config.d/*.conf
notify:
- "Reload systemd"
- "Restart ssh"
- name: "Configure ssh authentication policy"
become: true
ansible.builtin.copy:
dest: "/etc/ssh/sshd_config.d/99-auth-policy.conf"
mode: "0640"
validate: "{{ 'sshd -T -f %s' if (not ansible_facts['is_chroot']) else omit }}"
content: |
Port {{ ssh_port }}
PasswordAuthentication no
AuthenticationMethods publickey
PermitRootLogin no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
X11Forwarding no
StreamLocalBindUnlink yes
notify:
- "Restart ssh"
- name: "Add arg.username to allowed users"
become: true
ansible.builtin.copy:
dest: "/etc/ssh/sshd_config.d/99-allowed-users.conf"
mode: "0640"
validate: "{{ 'sshd -T -f %s' if (not ansible_facts['is_chroot']) else omit }}"
content: |
AllowUsers {{ username }}
notify:
- "Restart ssh"
- name: "Configure known_hosts"
ansible.builtin.known_hosts:
name: "{{ item.split(' ') | first }}"
key: "{{ item }}"
path: "/home/{{ username }}/.ssh/known_hosts"
state: present
loop: "{{ ssh_known_hosts }}"
when:
- ssh_known_hosts is defined and ssh_known_hosts | length > 0
# To ensure this is only run with user and not as a root
# to avoid creating the file with the wrong permissions
- not ansible_facts['is_chroot']
|
