From a02e756446b9b23beba6dcaa60845d1fa70488cb Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sun, 9 Dec 2018 14:03:05 +0100 Subject: renamed sshserver role to sshd --- dan/sk2013.yml | 2 +- dan/sk2016.yml | 2 +- roles/sshd/handlers/main.yml | 5 +++++ roles/sshd/tasks/main.yml | 40 +++++++++++++++++++++++++++++++++++++++ roles/sshserver/handlers/main.yml | 5 ----- roles/sshserver/tasks/main.yml | 40 --------------------------------------- spreadspace/calypso.yml | 2 +- spreadspace/dione.yml | 2 +- spreadspace/emc-master.yml | 2 +- spreadspace/emc-stats.yml | 2 +- spreadspace/emc-test.yml | 2 +- spreadspace/emc-xx.yml | 2 +- spreadspace/helene.yml | 2 +- spreadspace/telesto.yml | 2 +- spreadspace/thetys.yml | 2 +- 15 files changed, 56 insertions(+), 56 deletions(-) create mode 100644 roles/sshd/handlers/main.yml create mode 100644 roles/sshd/tasks/main.yml delete mode 100644 roles/sshserver/handlers/main.yml delete mode 100644 roles/sshserver/tasks/main.yml diff --git a/dan/sk2013.yml b/dan/sk2013.yml index 5caa6603..61263739 100644 --- a/dan/sk2013.yml +++ b/dan/sk2013.yml @@ -2,5 +2,5 @@ - name: Basic Setup hosts: sk2013 roles: - - role: sshserver + - role: sshd - role: vm/host diff --git a/dan/sk2016.yml b/dan/sk2016.yml index ef3d7c43..f8fa58b3 100644 --- a/dan/sk2016.yml +++ b/dan/sk2016.yml @@ -2,5 +2,5 @@ - name: Basic Setup hosts: sk2016 roles: - - role: sshserver + - role: sshd - role: vm/host diff --git a/roles/sshd/handlers/main.yml b/roles/sshd/handlers/main.yml new file mode 100644 index 00000000..822887e3 --- /dev/null +++ b/roles/sshd/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: restart ssh + service: + name: ssh + state: restarted diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml new file mode 100644 index 00000000..e638905b --- /dev/null +++ b/roles/sshd/tasks/main.yml @@ -0,0 +1,40 @@ +--- +- name: install ssh-server + apt: + name: openssh-server + state: present + +- name: hardening ssh-server config + lineinfile: + regexp: "^#?\\s*{{ item.key }}" + line: "{{ item.key }} {{ item.value }}" + dest: /etc/ssh/sshd_config + mode: 0644 + with_dict: + IgnoreRhosts: "yes" + PermitRootLogin: "without-password" + PubkeyAuthentication: "yes" + HostbasedAuthentication: "no" + PermitEmptyPasswords: "no" + UseDNS: "no" + loop_control: + label: "{{ item.key }}" + notify: restart ssh + +- name: limit allowed users + lineinfile: + dest: /etc/ssh/sshd_config + regexp: "^AllowUsers" + line: "AllowUsers {{ ' '.join([ 'root' ] | union(ssh_allowusers_group | default([])) | union(ssh_allowusers_host | default([]))) }}" + notify: restart ssh + +- name: install ssh keys for root + authorized_key: + user: root + key: "{{ ssh_keys_root | join('\n') }}" + exclusive: yes + +- name: delete root password + user: + name: root + password: "!" diff --git a/roles/sshserver/handlers/main.yml b/roles/sshserver/handlers/main.yml deleted file mode 100644 index 822887e3..00000000 --- a/roles/sshserver/handlers/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: restart ssh - service: - name: ssh - state: restarted diff --git a/roles/sshserver/tasks/main.yml b/roles/sshserver/tasks/main.yml deleted file mode 100644 index e638905b..00000000 --- a/roles/sshserver/tasks/main.yml +++ /dev/null @@ -1,40 +0,0 @@ ---- -- name: install ssh-server - apt: - name: openssh-server - state: present - -- name: hardening ssh-server config - lineinfile: - regexp: "^#?\\s*{{ item.key }}" - line: "{{ item.key }} {{ item.value }}" - dest: /etc/ssh/sshd_config - mode: 0644 - with_dict: - IgnoreRhosts: "yes" - PermitRootLogin: "without-password" - PubkeyAuthentication: "yes" - HostbasedAuthentication: "no" - PermitEmptyPasswords: "no" - UseDNS: "no" - loop_control: - label: "{{ item.key }}" - notify: restart ssh - -- name: limit allowed users - lineinfile: - dest: /etc/ssh/sshd_config - regexp: "^AllowUsers" - line: "AllowUsers {{ ' '.join([ 'root' ] | union(ssh_allowusers_group | default([])) | union(ssh_allowusers_host | default([]))) }}" - notify: restart ssh - -- name: install ssh keys for root - authorized_key: - user: root - key: "{{ ssh_keys_root | join('\n') }}" - exclusive: yes - -- name: delete root password - user: - name: root - password: "!" diff --git a/spreadspace/calypso.yml b/spreadspace/calypso.yml index cd6a9ac0..e205cba6 100644 --- a/spreadspace/calypso.yml +++ b/spreadspace/calypso.yml @@ -3,7 +3,7 @@ hosts: calypso roles: - role: base - - role: sshserver + - role: sshd - role: zsh - role: admin-user - role: blackmagic-desktopvideo diff --git a/spreadspace/dione.yml b/spreadspace/dione.yml index 70b6a077..75d65f69 100644 --- a/spreadspace/dione.yml +++ b/spreadspace/dione.yml @@ -3,7 +3,7 @@ hosts: dione roles: - role: base - - role: sshserver + - role: sshd - role: zsh - role: admin-user - role: blackmagic-desktopvideo diff --git a/spreadspace/emc-master.yml b/spreadspace/emc-master.yml index b12e8004..412faf29 100644 --- a/spreadspace/emc-master.yml +++ b/spreadspace/emc-master.yml @@ -3,5 +3,5 @@ hosts: emc-master roles: - role: base - - role: sshserver + - role: sshd - role: zsh diff --git a/spreadspace/emc-stats.yml b/spreadspace/emc-stats.yml index 767b58aa..aa4af19e 100644 --- a/spreadspace/emc-stats.yml +++ b/spreadspace/emc-stats.yml @@ -3,6 +3,6 @@ hosts: emc-stats roles: - role: base - - role: sshserver + - role: sshd - role: zsh - role: emc-stats diff --git a/spreadspace/emc-test.yml b/spreadspace/emc-test.yml index a8805fc7..12f2859f 100644 --- a/spreadspace/emc-test.yml +++ b/spreadspace/emc-test.yml @@ -3,5 +3,5 @@ hosts: emc-test roles: - role: base - - role: sshserver + - role: sshd - role: zsh diff --git a/spreadspace/emc-xx.yml b/spreadspace/emc-xx.yml index e2005178..4a6b52d2 100644 --- a/spreadspace/emc-xx.yml +++ b/spreadspace/emc-xx.yml @@ -4,6 +4,6 @@ roles: - role: hetzner-slim - role: base - - role: sshserver + - role: sshd - role: zsh - role: admin-user diff --git a/spreadspace/helene.yml b/spreadspace/helene.yml index d3619d9d..815cac9f 100644 --- a/spreadspace/helene.yml +++ b/spreadspace/helene.yml @@ -3,7 +3,7 @@ hosts: helene roles: - role: base - - role: sshserver + - role: sshd - role: zsh - role: admin-user - role: blackmagic-desktopvideo diff --git a/spreadspace/telesto.yml b/spreadspace/telesto.yml index 11b45596..64405e72 100644 --- a/spreadspace/telesto.yml +++ b/spreadspace/telesto.yml @@ -3,7 +3,7 @@ hosts: telesto roles: - role: base - - role: sshserver + - role: sshd - role: zsh - role: admin-user - role: blackmagic-desktopvideo diff --git a/spreadspace/thetys.yml b/spreadspace/thetys.yml index fffeb769..f1cb24dd 100644 --- a/spreadspace/thetys.yml +++ b/spreadspace/thetys.yml @@ -3,7 +3,7 @@ hosts: thetys roles: - role: base - - role: sshserver + - role: sshd - role: zsh - role: admin-user - role: blackmagic-desktopvideo -- cgit v1.2.3