diff options
| author | Christian Pointner <equinox@spreadspace.org> | 2018-12-09 13:49:00 +0100 |
|---|---|---|
| committer | Christian Pointner <equinox@spreadspace.org> | 2018-12-09 13:49:00 +0100 |
| commit | efaa87a06f6c34d7d8863f1b675176a4b88291b4 (patch) | |
| tree | c8e65326d6ad9b276aa46b62e1e876a68227643b /roles | |
| parent | apt without with_items (diff) | |
refactoring sshserver role
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/sshserver/tasks/main.yml | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/roles/sshserver/tasks/main.yml b/roles/sshserver/tasks/main.yml index cd4c5043..e638905b 100644 --- a/roles/sshserver/tasks/main.yml +++ b/roles/sshserver/tasks/main.yml @@ -6,24 +6,26 @@ - name: hardening ssh-server config lineinfile: - regexp: "{{ item.regexp }}" - line: "{{ item.line }}" + regexp: "^#?\\s*{{ item.key }}" + line: "{{ item.key }} {{ item.value }}" dest: /etc/ssh/sshd_config mode: 0644 - with_items: - - { regexp: "^#?\\s*IgnoreRhosts", line: "IgnoreRhosts yes" } - - { regexp: "^#?\\s*PermitRootLogin", line: "PermitRootLogin without-password" } - - { regexp: "^#?\\s*PubkeyAuthentication", line: "PubkeyAuthentication yes" } - - { regexp: "^#?\\s*HostbasedAuthentication", line: "HostbasedAuthentication no" } - - { regexp: "^#?\\s*PermitEmptyPasswords", line: "PermitEmptyPasswords no" } - - { regexp: "^#?\\s*UseDNS", line: "UseDNS no" } + with_dict: + IgnoreRhosts: "yes" + PermitRootLogin: "without-password" + PubkeyAuthentication: "yes" + HostbasedAuthentication: "no" + PermitEmptyPasswords: "no" + UseDNS: "no" + loop_control: + label: "{{ item.key }}" notify: restart ssh - name: limit allowed users lineinfile: dest: /etc/ssh/sshd_config regexp: "^AllowUsers" - line: "AllowUsers {{ ' '.join([ 'root' ] | union(sshserver_allowusers_group | default([])) | union(sshserver_allowusers_host | default([]))) }}" + line: "AllowUsers {{ ' '.join([ 'root' ] | union(ssh_allowusers_group | default([])) | union(ssh_allowusers_host | default([]))) }}" notify: restart ssh - name: install ssh keys for root |